https://www.reddit.com/r/apple/comments/52lp8o/ios10_installation_failing/
http://www.macrumors.com/2016/09/13/apple-ios-10-update-issue-fixed/
Cant’ say anything officially, but here’s a start: http://i.coschedule.com/c00a3
*Thread Reply:* I'm advised integration/APIs are linked to TouchID at the moment. ie. if you disable TouchID, then FaceID is disabled too
You’re most welcome, @aaron! Good find.
}
*Thread Reply:* e.g app v1.0 is installed, v1.1 is added to MDM and update command pushed.
*Thread Reply:* Does the ‘Use Cellular Data’ need to be enabled for v1.1 to be downloaded/installed? ~10MB update in this case.
*Thread Reply:* Nice! Could it be changed once the device is in the field? I’m not certain it would need to per se, but the client expressed interest in being able to tweak based on who was using the device.
*Thread Reply:* Yes-ish. You’d need to re-image the device. (Which is easy with GC.)
*Thread Reply:* According to the MI Community iOS11 Doc there is a known issue suiting your description
*Thread Reply:* @Woody it works REALLY well now, and no longer requires Ethernet. Plus you get tethered networking to usb-connected iOS devices.
*Thread Reply:* Did Caching require ethernet before 5.4? Yeah, I like how essentially any MacOS machine can now be a caching server on your network.
*Thread Reply:* @Jonathan Henson Are you attempting to prevent the user from storing U/P credentials for company sites/services?
*Thread Reply:* Managed Domains may be your best bet.
*Thread Reply:* That are you’re referring to also ties into iCloud Keychain (if enabled). So, perhaps another reason to use Managed Domains
*Thread Reply:* @Woody I'll have to look into managed domains. The iPads are handed to patients to submit online reviews for the facility. Each device has a set of 5 - 7 webclips that point to the various social media review sites for the facility. We want to make sure that John Doe doesn't save his Facebook login, etc on the device. iCloud is disabled on these devices.
*Thread Reply:* Settings > General > Restrictions > Accounts > Don't Allow Changes. (Disallowing changes prevents adding, removing,or modifying accounts in Accounts & Passwords).
*Thread Reply:* lol, that stops you from being able to manually edit accounts (like email accounts) but doesn't grey out apps & website passwords.
*Thread Reply:* @Jonathan Henson assuming the iPads are supervised (they should be) you can add a whitelist of web sites in a config profile. This restricts all other sites. That should do the trick.
*Thread Reply:* (You may also want to look at groundctl.com to easily wipe and reimage devices weekly.)
*Thread Reply:* So the device is already connected to the SSID and then AirWatch pushes down the profile to connect to the SSID? I’m pretty sure that doesn’t work. You’d need a second SSID to connect to the AIrWatch server.
*Thread Reply:* ok. say the device is newly configured in AirWatch. The device will receive a profile for the corporate SSID. then a user connects to the wifi and tries to go to google.com. Forcepoint (Websense) re encrypts the traffic and then presents it to the device with a cert. So regular cert chain would be Root then Issuing then site. going through forcepoint it goes Root, Issuing, Forcepoint SubCA, then site.
*Thread Reply:* So, if all the above is in place. When the device hits ForcePoint (Websense), does it require the user to authenticate to pass through the proxy out to the site they’re trying to access?
*Thread Reply:* no authentication required. It just re encrypts the traffic and the mobile device does not trust the cert chain. It thinks it is a "man in the middle" attack
*Thread Reply:* Gotcha. Have you tried sending out the cert chain for the ForcePoint directly to the device (as a Certificate configuration), so it’s placed in the Trust Store and inherently trusted by the device?
*Thread Reply:* Hrmm. If the chain is sitting in that store, the device shouldn’t whine about it. Have you installed that chain to a desktop? Curious if the chain checks-out.
*Thread Reply:* of course on the mobile device safari does not prompt you and give you the ability to trust it yourself. With Google Chrome on the ios device I do get the prompt.
*Thread Reply:* If you import the chain to the cert store and check the relationship between the Root/CA/SubCa/Cert, does it find any discrepancy?
*Thread Reply:* cannot I not post a pic in a thread?
*Thread Reply:* the device has all the certs in the cert store
*Thread Reply:* You have to do it in the main channel. IdK why they haven’t added photos inside threads just yet
*Thread Reply:* Got it. I think more of the issue here is that the device may know the identity of the destination site, which results in it believing ForcePoint is a MITM
*Thread Reply:* If it knew only ForcePoint as the responder for that SSL connection, it would have no basis for comparison and trust the connection
*Thread Reply:* Wouldn’t this need to be a proxy, not really MITM?
*Thread Reply:* “Transparent authentication is not supported. The user is always prompted for credentials.” https://www.websense.com/content/support/library/web/v81/wcg_help/auth_mac_idevice.aspx#1138360
*Thread Reply:* (not sure that is your product, but it makes sense to me)
*Thread Reply:* Also curious - What does the vendor have to say about this arrangement? Any suggested means of allowing mobile devices to access secure sites using their product? Surely this isn’t the first time a customer has encountered this.
*Thread Reply:* The vendor really has not said much. They did say that they always see issues with mobile devices lol
*Thread Reply:* Sounds like they’re not really concerned. Not sure they’re going to be a vendor you all will want to be dealing with long-term 🙃
*Thread Reply:* exactly we are always fighting with the network security team about forcepoint.
*Thread Reply:* Perhaps they create a second SSID for Mobile that bypasses ForcePoint? Or enforce restrictions for devices using that SSID, such as a Web Content Filter (Supervised Devices Only)?
It’s so worth it to break DEP to educate customers about accepting EULA’s
I need to object to this statement as it is incorrect. Device-based VPP can be used for all devices, regardless of DEP enrollment. DEP removes the requirement for the Apple ID on the device at device setup time. Device-based VPP removes the requirement for the Apple ID for app installation. So combining both removes Apple ID requirement for EMM environments altogether. But that does not mean that both technologies cannot be used separately.
}
Apple at Work - Hrmm, that sounds kind of familiar. https://www.apple.com/business/
https://9to5mac.com/2018/01/23/ios-11-2-5/
*Thread Reply:* Ah yeah, because having a central portal you can add and remove resellers from at will is proper stoneage 😛
*Thread Reply:* There ae only 2 of them!! lmao I'm gagging to try it... trying to get AT&T to get access for me at the mo.
*Thread Reply:* Agree. I’ve done this and it will work.
*Thread Reply:* Thank you, do you know which MDM solution on the market has this ability? (displays those details on their console).
*Thread Reply:* "For generic Android, we may also see a future capability for devices that run Android enterprise (formerly Android for Work) before long."
It's already possible to defer AE updates using any half-decent EMM 😛
Interesting change to apple device policy coming.
@Russell Mohr yeah, the AppConfig is now available on our (and probably any AppConfig supporting) EMM platform. Unfortunately it seems the file I uploaded her contains unnecessary whitespace in one of the keys ("com.microsoft.outlook.EmailProfile.EmailAddress "). This may render the config incorrect. At least I was not able to configure Outlook for iOS using it.
}
It states "When you create an app configuration policy in the Azure Portal or through your MDM provider, you will need the following key value pairs". So I assumed it to be default iOS managed app configuration. Today I just created a normal plist file with the described key-value pairs to configure the iOS Outlook app. But this did not work either. But now I don't know if this is because it's just not working as I expect or if there is a conflict between my plist managed app config and the configuration retrieved from the AppConfig repo.
*Thread Reply:* I know a guy who has the hookup on identity management, if you guys are heading that direction 😁
*Thread Reply:* I saw this few times with Exchange 2013 and iOS 10+. As far as I can remember, the workaround was to disable Local Time Zone from the Calendar settings.
*Thread Reply:* It’s not in 11.3 but in 11.4 Beta 1 🙂
*Thread Reply:* Ah, WTH! I wondered why there wasn’t any mention of it in the release notes. I thought it was a certainty in 11.3
*Thread Reply:* Well for now it’s a certainty in iOS Betas :)
*Thread Reply:* Managed contact topic is in 11.3 and it’s working
*Thread Reply:* Cool 👍:skintone2: How did you test it?
*Thread Reply:* I tested it with WhatsApp unmanaged vs managing it afterwards
*Thread Reply:* ok but is there no setting you have to push out via MDM for that to work? Simply deploy an Exchange profile via MDM and if WhatsApp is not managed the access for Exchange contacts is blocked by default?
*Thread Reply:* Managed Contact (as-in keeping your managed contacts from leaking into unmanaged apps)?
*Thread Reply:* In MobileIron there is a setting in iOS restrictions where you can allow/disallow data exchange between managed and unmanned content. If you restrict unmanaged access to managed data. Access is denied.
*Thread Reply:* Do you mean: „Allow documents from managed apps to unmanaged apps“ - I thought this is only to restrict Open-In, not the access of the managed contacts for unmanaged apps.
*Thread Reply:* Ok well then its not really working. Deactivated both options in the restrictions, but contacts are still visible in WhatsApp. And WhatsApp is not managed!
*Thread Reply:* Ok tried it again with a fresh device, no chance. I think we are talking about different things. I am deploying an Exchange config into the native mail app on iOS and due to the iOS release notes it can be possible to prevent WhatsApp from accessing the contacts from the native mail client. I believe you are talking about AppConnect Apps like Email+, not the native client.
*Thread Reply:* From my testing WhatsApp worked. Are you sure you applied the Allow managed to unmanaged restriction? I’ve heard that iMessage is considered as unmanaged app... any clue or info?
*Thread Reply:* I applied an standard MobileIron iOS restriction (Core 9.6.0.2) with the setting „Allow documents from managed apps to unmanaged apps“ unchecked. No idea if iMessage is considered unmanaged.
*Thread Reply:* I am talking about native iOS apps for contacts, mail, calendar etc. I also push an exchange confit to the device. Message app is something like hybrid. If I use the plus button in the to field, I get only access to unmanaged contacts. If I type the name directly in the to field it provide matches also from managed contacts.
Do you provide more then one iOS Restriction configuration to the device? As far as I know it must be only one.
*Thread Reply:* I have both options about managed to unmanaged and unmanaged to managed disabled
*Thread Reply:* Solved it - that was more than strange. Complete device issue that I have never seen before! Downgraded the iPhone 5s from 11.3 to 11.2.6 and upgraded back to 11.3 - all via iTunes. After that, everything worked like you described! 🤔
*Thread Reply:* @NicolasR you are right, it seems that the message app is considered unmanaged. This is not ideal an could be a dealbreaker for a lot of deployments. Is this known to anyone else?
*Thread Reply:* Found the workaround for the message app problem - you are able to send a message to managed contacts from within the contacts app.
*Thread Reply:* Or type the name of a managed contact in the receiver field of the message app. You will get an overview of all contacts (managed and unmanaged) that mach to the name you typed.
*Thread Reply:* So what is not available from iMessage app?
*Thread Reply:* Deferred updates made it in, and works.
*Thread Reply:* Yes I think this will work, I was hoping to get something a bit more Accountable to the user, but I think that's just the limitations we have to work with. We also have the volume limit this way with it being a max of 100 devices connected in this way
*Thread Reply:* Yeah, it’s not pretty but it does do the trick
*Thread Reply:* It’s better than AAs running around with their Executive’s mailbox loaded to their personal phone (unmanaged)
*Thread Reply:* Yeah Rob, it’s just a cert/Exchange profile being sent down. Supported from a technology perspective, anyways.
@Tobias can you send me the full corrected version? I’m told there are also some supplemental parameters coming from another source at Mobileiron. Where was the exact error again?
}
Today I configured an "Exchange" account to the iOS Outlook app using "outlook.office365.com" as server name. The behavior is the same as before. You need to enter a password (cannot be set through AppConfig) which is completely ignored as soon as Outlook detects the mail address as being O365 hosted. It switches to modern auth and redirects to the IdP (here ADFS).
So preconfiguring Outlook for iOS with managed app config is really just for on-prem Exchange (as the MS article states).
*Thread Reply:* Not target a specific iOS version, but delay the installed version which does need to be signed!
*Thread Reply:* Thanks @Simon Hardy-Bistagne. Didnt realize this.
*Thread Reply:* Been raised as a big to apple. Will see what happens.
*Thread Reply:* Can you provide a bit more detail on the device, OS, timezone (from/to) and calendar backend platform? I haven’t heard of this, but it is intriguing.
*Thread Reply:* So, iPhone (follows her from iPhone 7, through to now her X).
Native iOS mail client.
Backend is Office 365, and device is 11.3 and 11.2
Doesn't effect her iPad.
Timezone change is any to any.
*Thread Reply:* Wow, that is odd. Do you have access to O365 tenant settings?
*Thread Reply:* Sure do.
Can't see anything out of the norm on her end.
*Thread Reply:* Origionally thought it was a corrupt calendar, as it followed her to new devices but she always did a device restore to set the new one up.
But set her a fresh device up, no restore, and when she landed lately, it worked fine... until she connected to wifi and the calendar wiped.
*Thread Reply:* Yeah... it’s a mind bender... that’s for sure
*Thread Reply:* I can’t find anything that would be the cause for this sort of thing. Worst case, recreate the mailbox?
*Thread Reply:* I think we've found the issue...
Seems this exec has been entirely disabling location services on her device. I think this has been playing games with the timezone changes and potentially the agent compliance checks.
Strange it's only effecting the calendar and not other items, but enabling location setting seems to have resolved for the moment.
*Thread Reply:* I can reasonably tackle the Android enterprise side of this, but I want to remain objective and obviously I have a natural bias, as would those focusing primarily on iOS.
When Google mentioned it going to partners (EMMs, ISVs, etc) I thought this would be a great opportunity to 1) provide a factual comparison and 2) highlight the level(ish) playing ground both OS' are fighting on.
If anyone would like to get involved I'll share more details 🙂 I want to turn this around quite quickly. No financials involved, I volunteered to help the ecosystem as I've done with the rest of my docs.
*Thread Reply:* Perfect, I'll get what I've got so far "shareable" and ping you.
*Thread Reply:* I worked on something similar while at Apple for education space during Apple School Manager days. If there is something I can do to help. I would love to.
*Thread Reply:* Openradar is only to show to the community which are the open radar while Apple doesn’t provide any access to bugs reported.
about this MS Article: https://docs.microsoft.com/en-us/intune/data-transfer-between-apps-manage-ios#configure-user-upn-setting-for-third-party-emm
Which App bundle ID should I assign to the managed appconfig?
This document is very unclear: https://docs.microsoft.com/en-us/intune/data-transfer-between-apps-manage-ios#configure-user-upn-setting-for-third-party-emm. I do not know what to make of it; if Intune app protection policies are needed for this or not.
But you can always try by just sending the PLIST. It seems like the app (Word for example) will respect managed vs unmanaged Open In on iOS. In the JSON i have sent before, all Microsoft and 3rd party apps that should be able to use it are listed (https://www.microsoft.com/en-us/cloud-platform/microsoft-intune-apps). It's in JSON format, so you need to search for the App you need and there it will have the App Bundle ID.
*Thread Reply:* Update: Was able to engage the frustration shake and pull logs from within the app. Apparently WS1 is doing some sort of lookup on my device and redirecting me to an AirWatch tenant that’s not actually mine.
*Thread Reply:* Yeah! Kind of interesting. I sent the details over to their team and anxiously await more detail as to how the internal flow of that function works
*Thread Reply:* So is it going to an actual other AW instance or just an unknown URL?
*Thread Reply:* I’m having a hard time understanding how that could happen. That is nuts.
*Thread Reply:* Well, this WS1 tenant was switched back and forth between a couple AW instances. I think it may have gotten mixed-up in the shuffle
*Thread Reply:* I kind of understood WS1 would use the OD name to lookup the AW tenant… and I think that may be where the wheels came off
*Thread Reply:* Senility seeing in with AirWatch hey!
*Thread Reply:* plug in xCode and hit Go.
*Thread Reply:* Not yet... But want to hear the answer from anyone who has!
Our apple reps have all told us there will be no issues...
*Thread Reply:* We migrated DEP. Working on VPP. DEP migration was touchy. They said we didn’t need to recreate the DEP tokens, but we did. So, there’s that.
*Thread Reply:* Eww recreating the tokens...
*Thread Reply:* We talked with Apple as well and they said the same thing to us: would be no issues.
Definitely want to upgrade.
*Thread Reply:* Already having the default EMM endpoint based off of device type has helped us immensely.
*Thread Reply:* Token re-creation was really just like a renewal.
*Thread Reply:* Not super bad, but not expected either.
*Thread Reply:* Default EMM Endpoint, as in iPad goes here, iPhone goes there @jafullersr?
*Thread Reply:* Not much risk in token recreation. Devices already have profiles assigned... but with VPP there is more risk. Good luck!
*Thread Reply:* Yes, we set specific endpoints for specific devices due to purpose built configurations. @Woody So far it’s been working great.
*Thread Reply:* I appreciate all the feedback. @jafullersr what was touchy about the DEP migration other than the recreation of the DEP tokens?
*Thread Reply:* I migrated a DEP account with 20 tokens
*Thread Reply:* VPP sToken for the program agent (first DEP admin) was also migrated when I enabled VPP
*Thread Reply:* I do see issues with other existing VPP sTokens created by other admins in my domain though.. You can point them to a “Location” in ABM but I don’t believe they are really added to the ABM portal
*Thread Reply:* Or at least, the other tokens aren’t reflected in the license totals for all of my VPP tokens
*Thread Reply:* So... We have ping infront of office365 carrying out the authentication.
Ping has a connector into Airwatch so that as a part of its policy you can set that the device accessing must show as compliant in Airwatch.
The rest of the ping rule is written so that any mobile device accessing office 365 via the outlook mobile app must be compliant within Airwatch.
Of course the rule only applys to mobile traffic not desktop.
This allows us to basically allow an office 365 conditional access rule to all mobile devices using outlook mobile, but only ones Airwatch say are compliant will get through.
Just one thing to consider, ping does device ID via certificate so you will need a pki setup deploying certificates.
*Thread Reply:* Thanks @Simon Hardy-Bistagne
*Thread Reply:* Nice explanation, @Simon Hardy-Bistagne!
*Thread Reply:* We do something similar except that we also do mobileSSO via ViDM so no passwords to worry about!
*Thread Reply:* @Woody you remember our in-depth discussions on that ! 😆
*Thread Reply:* Oh yes @Damian! I’m all about that haha
*Thread Reply:* Doing lots of it with WS1/AirWatch (and now MI Access)
*Thread Reply:* Good to hear man - exciting times with IDM and mobility!
*Thread Reply:* That iMazing sounds good. Gotta give it a try! Thanks 👍:skintone2:
http://mobility.digitaldimension.solutions/en/emm-migration/
*Thread Reply:* Yes it unfortunately works for us 🙂 Because I don't see my corp contacts in Whatsapp
*Thread Reply:* And I created a lot of personal contacts in the corp address book by mistake because it doesn't give you the choice or remind you when you create them.. It just picks the 'default' that's buried in settings and resets every time you re-enroll. DOH
*Thread Reply:* This doesn’t work then as this should allow to see contacts in WhatsApp
*Thread Reply:* Oh yeah sorry, good point! But I don't know whether we had the key set or not. I assume not as our Intune test config is quite restrictive. We also disallow third party keyboards.
I was assuming the key you mentioned was a restriction key. I'll check it tomorrow!
*Thread Reply:* This key is new and surely intune has not this in the UI. You need to add it manually through plist file
@Matthew Shaver Looks like com.apple.measure, based on this: https://github.com/joeblau/apple-bundle-identifiers
*Thread Reply:* I believe this is tied to a feature called callkit. It was made for VOIP apps, but as I understand it other apps can use it’s code to display contacts for incoming calls
*Thread Reply:* If the app is using CallKit, you can enable it using Settings / Phone / Call Blocking & Identification. If your app supports it, you can allow it here to provide the Caller ID.
*Thread Reply:* So basically what you are saying is that the caller id resolution should work when connected to car via Bluetooth using iOS Email+? Because Email+ uses the callkit!
*Thread Reply:* Yes; when you enable the Email+ app to be used for identification, and you receive a phone call, the contacts in Email+ will be used to identify the caller ID. But there are some limitations; maybe you car only copies the contacts and shows only contacts copied for example.
*Thread Reply:* Yeah well no clue but caller id resolution definitely does not work when connected to car Bluetooth
*Thread Reply:* Does it work at all? So without BT and a connected car?
*Thread Reply:* It works on the phone, but not on the car display while connected! 😊
*Thread Reply:* Ok, so it's really a matter of how the car interacts with the device. It probably just copies the local contacts (native contacts app) and uses those for the caller ID. Not much you can do about that. Maybe talk to the car manufacturer... or buy a car with CarPlay 🙂
*Thread Reply:* What app did you test this with?
*Thread Reply:* I can't find an app with that name, maybe not available in my store (country). However tried some other apps (calendar widgets) and those still seem to be able to get the managed calendar info.
*Thread Reply:* This is with MobileIron as MDM. Restriction set for Managed to Unmanaged. Weird issue!
*Thread Reply:* Funny thing, I am getting customer feedback that it's not working anymore also.
*Thread Reply:* For example, this app has a FAQ item on it: https://weekcalendar.zendesk.com/hc/en-us/articles/360016079071-Exchange-Calendar-Invisible-iOS12-MDM
*Thread Reply:* I re-listened to the whole thing last night—It’s pretty good 🙂
https://gizmodo.com/apple-reportedly-blocked-police-iphone-hacking-tool-and-1829974710
*Thread Reply:* FWIW Apple has done this UAMDM on Mac for a while (since 10.13.2), this is why I amended the process to enable the user to manually click that.
The biggest change actually is that under High Sierra it wasn't super needed, the only real actual ability that was blocked without it was the loading of kernel modules. But in Mojave there are a bit more things under it.
*Thread Reply:* But yet they still haven't added a work profile mode which I really love on Android because it allows you to keep the work part completely separate. I really wish Apple would do that.
*Thread Reply:* I think the UX on work profile is really great. One tap and all work stuff is off, and you can still use the same apps for personal use.
*Thread Reply:* Thanks for explaining that. I’m deep in the Apple bubble, so was only partially aware of that. Seems like something Apple could easily implement for unsupervised devices.
*Thread Reply:* Or even supervised ones, as long as there is an option to disable.
*Thread Reply:* Yes that's the big benefit of work profile mode. It's ideal for BYO scenarios. It creates a container on your phone with all your work stuff, and only that container is managed by the company. The MDM can only 'see' inside the container, e.g. it can't even see what apps you have installed personally.
So it's a good balance between privacy and security. Any apps installed into the profile will get a badge on top so you can tell the difference between them and the same app on your general phone. You also have separate storage so you can make sure corp. info can't be shared to personal apps if you like (we do this). And I really like the way I can just toggle the work profile off, which means all notifications will be muted (and even the background app update disabled for work apps).
*Thread Reply:* With Apple you only have the full enrolment option really (though you do have the supervised/non supervised difference)
*Thread Reply:* What happens if you have the same app in both work and personal? Two copies?
*Thread Reply:* Yep. Work Camera and Personal Camera etc
*Thread Reply:* That wouldn’t be the Apple way then.
*Thread Reply:* Not in the way Android do it, but they wouldn't necessarily have to implement it in the same way. I could see Apple making something where you "flip" the screen around to a second homescreen for business. Until recently a dual-sim phone wasn't Apple's way either but they turned that around too.
They'd just make the difference more clear. And the 2 camera's aren't a good example, they're not needed in most cases because you can usually share from personal -> Work, just not the other way around. But having 2 mail apps is quite handy IMO. I just wish they were a bit easier to tell apart, there's only a tiny overlay while using them. Having one with a work branding or different tint colour would be better.
Especially considering Apple's pricing now I don't think they can keep expecting people to buy phones privately if they already get one for business 🙂 It's really what put me off Apple. I've been using Macs since OSX 10.2 and iPhones since the iPhone 1. But I really won't consider spending as much on a phone as they're asking now...
And I think while Google's way is not perfect it's definitely an out of the box rethink that better addresses how to combine work use with private use. For example: One thing that I really don't like with Apple's way is how easy it is to mistakenly create a contact in the wrong address book. Most of my personal contacts on my iPhone were in the work address book so when I unenrolled it from MDM they all disappeared from my phone. I've also several times sent an email to colleagues from my private address by mistake which caused the email address to be added to their reply lists, and it took a long time to get that address off everyone's address books again 🙂
*Thread Reply:* Great response. Much to think about.
*Thread Reply:* We are seeing sluggishness too. Mainly with opening meeting invites with large number of invitees (20+). We opened a support case with Apple, but they didn’t really want to know about it.
*Thread Reply:* It seems like any time I launch Calendar… there’s a 5-10 second wait until it’s responsive
*Thread Reply:* I see GAL lookup issues since iOS 12 (+ office365)
*Thread Reply:* My phone (BYOD) has a combo of calendars from iCloud, O365 and Gmail… so it’d be tough to say
*Thread Reply:* Sluggish calendar and GAL lookup issues for me too
Suggest to read: https://docs.microsoft.com/en-us/azure/active-directory/authentication/active-directory-certificate-based-authentication-get-started and follow the configuration and requirements from there.
*Thread Reply:* @Damian how do you systematically do this?
*Thread Reply:* We use AirWatch and the feature exists to revoke the token but only if your onprem UPN matches your cloud UPN. It’s not our case and we have to create a script to address this
*Thread Reply:* I’ve requested a feature enhancement since July this year
*Thread Reply:* That is a very good point Aaron. While I initially focused on the negatives of the idea from an MDM enrollment process I didn’t think of the security aspect
*Thread Reply:* In terms on implementation, I don’t think it is workable for Apple to ensure if it is a trusted agent.
*Thread Reply:* All of the agents are on their App Store and go through the rigor of their vetting process. Couldn’t there be extra rigor for MDM agents? It’s really just a thought, but this separation of the profile from the process is a pain.
*Thread Reply:* More thinking out loud: Apple could move more of the invasive MDM features over to DEP/supervised (like device wipe, app polling, device-wide VPN). That would make MDM enrollment slightly more benign. But, as long as MDM can be used to trust enterprise developers, then it’s still a route for installing malware. So we’re stuck.
*Thread Reply:* Maybe it’s just that enterprise-signed apps on BYO shouldn’t be a thing?
*Thread Reply:* extreme, but I could see there being a case for “If you don’t own the device, the app has to go through the public store”
*Thread Reply:* and then non supervised/ non/DEP MDM has a much more limited scope, like MDM light; much more palatable for BYOD; maybe allows multiple enrollments, etc.
*Thread Reply:* As I wrote… https://www.brianmadden.com/opinion/Its-okay-to-say-no-to-BYOD-and-have-two-phones-for-users-or-IT
*Thread Reply:* The way for Apple to implement your suggestion would be to use a new entitlement for App Store apps. The entitlement system is already used for CarPlay apps, GPS apps, VoIP apps… This would be an entitlement that declares “I’m allowed to install an MDM profile without extra effort.”
*Thread Reply:* By using entitlements, Apple could keep a close watch on MDM apps to make sure they are legit.
*Thread Reply:* ⬆️ This. This right here. Thanks @aaron
*Thread Reply:* Hm I don't think this is true, it has happened several times to me that it did offload managed apps when I was still using iOS. However this was in the iOS 11 days.
*Thread Reply:* I know because it caused some issues with my compliance: One time it offloaded Lookout which is required for our compliance 🙂
*Thread Reply:* I’m just stating what Apple officially told me 😉
*Thread Reply:* However we have seen some cases whereby WS1 was offloaded
*Thread Reply:* I opened a case but they didn’t have enough data and needed debug profiles installed to gather the necessary data - we’re obviously not going to do that for all our users...
I’ve had an article about some of these BYOD deficiencies that I wrote almost 2 years ago; I published an updated version today. Maybe it can be useful for helping to spread the word: https://www.brianmadden.com/opinion/Apples-iOS-management-protocol-needs-to-get-better-for-BYOD-Heres-why-and-what-they-could-do
*Thread Reply:* Totally agree, I've been thinking roughly the same regarding work profile. Android is really innovative with Work Profile and I really miss that user experience on an iPhone. But this really clarifies the point, I'll archive it, thanks!
*Thread Reply:* Though we are seeing a big move to app-based MAM and basically to abandon the MDM concept altogether for BYOD. By the time Apple catches up this could be the main method in use, and it already works on iOS. Users tend to like this a lot, even if they miss out on the easy on/off feature of Work Profile, because they still perceive our MDM client as "spyware" in many cases.
*Thread Reply:* Do you just recompile from source code in Xcode and then install it? I know a couple years back they started allowing people to sign apps for usage on their own devices without paying $99 to join the dev program
*Thread Reply:* @Jack Madden yes. You can still sign them, but the signing expires after 5 or 7 days.
*Thread Reply:* Ah okay. My colleague has been playing with this, so we’ll see when it expires
*Thread Reply:* He just saw that Cydia Impactor makes the resigning/installation process ridiculously easy.
*Thread Reply:* Plus, we found a site installing apps via enterprise certs in about 2 seconds of googling.
*Thread Reply:* Yeah! That Impactor tool is pretty awesome. I always heard “signing as a service” was very much available. Apparently it still is!
Here are the numbers, BTW: https://www.brianmadden.com/opinion/How-bad-are-mobile-security-threats-Our-look-at-the-numbers-starts-with-Google-and-Lookout
*Thread Reply:* Interesting.. Thanks!
*Thread Reply:* I normally record in QuickTime and blur in post production when capturing iOS.
Are you looking for live capability?
Maybe something like OBS would be a good option. Switching to a scene which has that section blurred.
*Thread Reply:* I don’t know of anything that can blur on the fly. I do all mine post in SnagIt and Camtasia.
*Thread Reply:* I just cut those out and add a cross-fade in hitfilm express or imovie
*Thread Reply:* I record in QuickTime and cut it in CuteCut for Mac. Why CuteCut? I use CuteCut on iOS too...
*Thread Reply:* Thanks for the great input!
*Thread Reply:* Indeed!! And they have done the purchasing via in-app so technically it should play fine with O365 subscriptions on VPP. Will give it a try tomorrow. If it doesn't interfere with my existing installation I might just assign it to everyone.
This will make DEP much more feasible too due to not having to include this anymore, it's by far the biggest package.
*Thread Reply:* Amen, @Jack Madden! Baby steps is MSFT’s MO these days
*Thread Reply:* It plays pretty nice with existing installations too! I was afraid it would install side by side or just kill the existing one without asking (which is what happens if I just push the installer through Munki for new versions)
*Thread Reply:* After installation I get like 10 of these in a row... That's not so nice (yes I clicked always allow every time) - had to enter the same password every time too.
That's something I'll have to see about before pushing this to the users with existing installations. Somehow it doesn't gracefully take over the old local installation's rights.
*Thread Reply:* Ok so Microsoft's Mac expert is live in macadmins in the office channel. So the issue is that the old apps are signed with MS's key and the new ones with Apple's let so they don't get the access. But he's provided a tool to delete the items from the keychain. Will check tomorrow. Just wanted to mention here in case one of you run into this too.
Of course the user can't be opening any O365 apps during app store installation so it'll have to be a scripted migration that enforces the right order of things. Will think about it.
*Thread Reply:* FAQ goodies: https://docs.microsoft.com/en-ie/deployoffice/mac/deploy-mac-app-store
*Thread Reply:* This? https://emm.how/t/ios-12-1-3-beta-4-changes-to-mdm-enrolment-workflow/917
*Thread Reply:* From Apple: In order to to improve platform security by reducing misleading profile installations, iOS 12.2 beta includes a new workflow for manually installing configuration profiles. Apple plans to test this workflow in iOS 12.2 beta and include it in iOS 12.2 GM.
*Thread Reply:* Should be noted there is a MAJOR change from previous beta testing. In the past few versions, if the profile was not installed within 24 hours, it would automatically be deleted. They have now lowered that time to 8 minutes
*Thread Reply:* I think the 8 minutes thing is to guarantee that the MDM will not reject the device when it will connect...
*Thread Reply:* Otherwise the app will not be activated and the client will be installed but not synchronised
*Thread Reply:* On Core it’s possible to change the value
*Thread Reply:* As far as I know Cloud is set to 24hours
This was on TechMeme today; I never heard of them before now but does anybody have any experience with them (or heard of them?) https://venturebeat.com/2019/01/28/mosyle-raises-16-million-to-streamline-apple-device-management/
*Thread Reply:* Venture Beat continues it’s uneven journalistic endeavors by writing about them like MDM is something brand new that nobody has ever seen before. I haven’t come across these cats yet, but it seems like they’re trying to position themselves as a cost effective competitor to JAMF
*Thread Reply:* Reminds me of the 2011-2012 era when we’d average one MDM product launch/MDM startup/MDM acquisition per week
Apologies if this came up already, but did anybody see the recent iPod Touch rumors? Long live 4" devices (I suppose) https://www.macrumors.com/2019/01/25/new-ipad-models-7th-gen-ipod-touch-ios-12-2/
*Thread Reply:* It’s been the perennial topic of conversation on podcasts with @aaron and @Russell Mohr
*Thread Reply:* In the Capitol Region of Denmark they have about 4.000 iPods in use for the healthcare system used with Honeywell scanners.
*Thread Reply:* Yep... and holy f**k balls...
This is a massive one... Apple have disabled the group FaceTime servers which "should" stem this from being exploited, however I'm seeing reports that this exploit still works.
I'm disabling FaceTime on our top exec iOS devices until a patch is made available,.
*Thread Reply:* Apple have disabled Group FaceTime. Good timing, I was about to send a mass communication to users :-) https://www.apple.com/support/systemstatus/
*Thread Reply:* TBH I would still send out comms around the issue. It's going to be in the news today, and users (and top execs) will have questions, so it's better to get head of it. Not necessarily via email, but Yammer post or blog post on your internal sites.
What worries me more here, isn't the exploit its self, but the fact that built into the code of iOS is the ability to remotely enable your microsoft and camera.
This is something that should be security coded into the OS that can not happen without a user giving approval every time.
This negates many of the arguments that Apple has around security.
*Thread Reply:* Interesting sidenote, FaceTime is one of the restrictions that’s getting deprecated to Supervised-only
https://www.theverge.com/platform/amp/2019/1/30/18203551/apple-facebook-blocked-internal-ios-apps
:no_upscale()/cdn.vox-cdn.com/uploads/chorus_image/image/62966498/acastro_180928_1777_facebook_hack_0001.0.jpg)
Google’s also peddling a data collector through Apple’s back door – TechCrunch https://techcrunch.com/2019/01/30/googles-also-peddling-a-data-collector-through-apples-back-door/ Let’s see if they do the same to Google...
*Thread Reply:* There are a few twitter accounts or websites which you can follow to receive a notification when a new version is released. i prefer https://twitter.com/iOSReleases
So, a couple of interesting things here: https://techcrunch.com/2019/02/12/apple-porn-gambling-apps/
*Thread Reply:* Hmmmm....
So that's not a crazy idea. Integrate Enterprise apps with the appstore (much like google) would resolve some of the distribution issues.
Interesting they focus so hard onntheporn aspect. As far as I know, making "porn" apps for internal Enterprise use doesn't specifically break and t's&C's, the distribution outside the enterprises certainly is though.
*Thread Reply:* But if there was a compromise then all your apps are impacted isn't it? Speaking from security perspective.
*Thread Reply:* I don't see any real risks.
All the cert does is allow an app you've created, run on an iOS device outside of the AppStore. If a 3rd party got the cert, then the most they can do is sign their own apps with it until it expires in under 12 months. And that won't impact my security. Potentially if Apple got wind they might can the cert but it's a very unlikely situation. It's no more risky that a company deploying the Root CA cert ot all their desktop devices. It's BAU.
Access to corporate dats on own own internal apps isn't covered by an app signature.
If anything, when I'm signing apps with a single (or small amount) of internal signing cert, i am more confident that the apps on my users devices are genuine. At the moment, I can set my MTD to flag apps which are signed by a 3rd party as a risk, apart from those apps which are carrying my cert. If i had to do that for 150 different certs, all expiring throughout the year i'd have to employ a persona to just carry out the task up updating the MTD policy.
Also, when it comes round to renewals, it's a single, simply push for all my enterprise apps to ensure they keep running. If i had to resign each individually, and redeploy then my life would be hell.
*Thread Reply:* The enterprise developer account for internal apps only allows 2 distribution certificates to be in use. So you don’t really have a choice. But I agree with Simon that a single cert or two on rotation with a single team responsible for it, is a much simpler and more manageable approach.
https://www.gottabemobile.com/ios-12-problems-5-things-you-need-to-know/
https://blogs.vmware.com/euc/2019/02/ios-devices-mdm.html
*Thread Reply:* They've done something similar on Mac already, yes..
I would really have preferred if they just put up a big warning screen with the implications instead. Getting the users to hunt around in the settings menu is not great IMO, and it doesn't really address the issue (possibly granting malicious actors access) as well as a good system dialog with a clear warning of what they are about to agree to.
But it's Apple so we'll just have to make do with what they decide.
*Thread Reply:* Our users are going to love this...it’s not as if the enrollment procedure isn’t long winded enough in its current form 🙄
*Thread Reply:* Do you know which iOS GA will include this?
*Thread Reply:* It’s not mentioned in the article
*Thread Reply:* It’s already in beta - I’ve confirmed and bloody annoying
*Thread Reply:* Will probably be included in the next minor update or so
*Thread Reply:* Yeah but that doesn’t help us prepare 😊 we need to update all our enrollment guides...
*Thread Reply:* This article should include a visual of Android Enterprise (Work Profile) enrollment as an alternative 😬
Just wanted to share a nice tool for automated build and deployment of In-house Apps: https://ebf.de/en/solutions/incapptic-connect/ https://www.incapptic.com/
}
*Thread Reply:* That first part (the admin only controls the work profile) is not strictly the case, even in standard work profile modes (not COPE or COBO) you can control several things at the device level. For example we block sideloading even on the 'main' side of the phone through the agent, and we load WiFi profiles with certificates. We also install lookout that scans a lot on the phone and the surrounding networks.
But yes, the phone personal data is much better protected from the agent on a work profile. I also really like the way you can just switch off the work side. Apple has a lot of catching up to do there.
*Thread Reply:* True, from an Android perspective we do enforce encryption of the device and a device password but in regards to splitting work from personal its night and day...
*Thread Reply:* Oh yeah true, I forgot those but we do them as well 🙂
*Thread Reply:* Not completely true. An admin can set the permissions of the MDM profile and for instance prevent full wipe of the device. Possible with MobileIron Core but not Airwatch I think
*Thread Reply:* In that case, user see during installation of the MDM profile a statement accordingly to the permissions
*Thread Reply:* Not sure what you mean by preventing full wipe via the MDM profile via admin... isn’t it the same as restricting the option to wipe the device in the AW role permissions of the admin accounts?
*Thread Reply:* Nope. An MDM profile can have a set of permissions that are set inside the payload which prevent the MDM to take the action even if the UI allows this.
*Thread Reply:* See page 16 https://developer.apple.com/business/documentation/MDM-Protocol-Reference.pdf#page16
*Thread Reply:* So you can do this in Mobileiron but not AirWatch ?
*Thread Reply:* Figure of speech, not nonsense 😝
I’m not trying to define BYOD as to whether or not the device has an agent. An agent on an iOS device in the traditional sense is MDM which allows an admin to do what they like if they have the rights...MAM on the other hand is an acceptable scenario for BYOD as long it covers jailbreak, minimum OS version etc...device passcode enforcement however requires MDM. Again, not easy to define a true BYOD policy for iOS.
*Thread Reply:* Not easy to define BYOD on iOS mate 😉
*Thread Reply:* Everything is done with Apple's MDM Protocol...there's no need for an agent. : )
https://developer.apple.com/business/documentation/MDM-Protocol-Reference.pdf
*Thread Reply:* Only if you can rewrite them in the form of: mibrowser://<intranet_link>
*Thread Reply:* Ok got it. Like rewriting intranet link with Exchange, not sure if that is possible
*Thread Reply:* Pass, beyond my level of knowledge, I’m afraid. Is Safari + Tunnel not suitable for your needs?
*Thread Reply:* Tunnel is Platinum 😜 we only have Gold!
*Thread Reply:* Ok, so it’s not a valid security risk reason why you’re not upgrading, just that you’re being tight-fisted? 😉
*Thread Reply:* Joking aside, Tunnel is a tremendously powerful and user-friendly feature that accelerates adoption, use and satisfaction for many organisations - though I can’t make the value vs price decision for your company, of course.
*Thread Reply:* You can use the KVP’s: allowsafaribrowser = false, emailurlschemehttp=mibrowser and emailurlschemehttps=mibrowser
*Thread Reply:* @Almar Diehl 👍:skintone2: great, thank you. That would mean links received via Email+ would only open with Web@Work, sounds good. Non-Company links received via Email+ would then also be opened with W@W, so I think there is no way to differentiate by domain name. @Jason yes I agree with you, Tunnel is great but not in the budget right now.
*Thread Reply:* Thank you Yasar. Glad to be of help!
*Thread Reply:* Corporate owned enrolled with DEP is not affected @Yasar
*Thread Reply:* Devils advocate if I may - what would be the point? There would still be nothing stopping the user from taking the photo and saving it to their personal stream. Doesn’t MI provide a containerized documentation app that could be used for securely storing anything business related?
*Thread Reply:* Agreed, but same goes for Android Enterprise then, where you can also have two camera apps. In the end it is up to the user, but they need to sign a waiver for that. Yes, Docs@Work but you can‘t take pictures with Docs@Work though.
*Thread Reply:* I can definitely recommend some camera apps to unify the experience in AE work profile, but nothing on iOS - though a Box For EMM account would probably do the trick if there is the budget for it. We use it internally and between that and Slack, I barely touch my email for internal communications anymore 😂
*Thread Reply:* You Can use Captor https://marketplace.mobileiron.com/listing/captor%20for%20mobileiron
As for Ethernet: you can buy (yet another) dongle to supplement your life in Apple’s bubble: https://9to5mac.com/2017/03/01/ios-10-2-ethernet-adapter-ui-settings-app/
*Thread Reply:* Yes..you need to manually install the profile by going into settings. I just checked on my ios device with intune
iOS 12.3 beta is out: https://www.macrumors.com/2019/03/27/apple-seeds-ios-12-3-beta-to-developers/ Appleseed has been updated
*Thread Reply:* The infinite problem with apple is that they act and after only they think that maybe they impacted businesses...
*Thread Reply:* I would say, depending on your needs 😉 Some will say Jamf, other will say UEM vendor such as Vmware or MI... but again, it really depends
*Thread Reply:* Had a look at Fleetsmith? (https://www.fleetsmith.com/)
*Thread Reply:* Here’s “best” for Uber: https://mobilxperts.slack.com/archives/C1U1G6PGR/p1554395025040900
}
*Thread Reply:* Uber is a MobileIron (Cloud) customer :-)
*Thread Reply:* Thank you for the suggestions. Will study all of them considering my needs.
*Thread Reply:* CommunicationServiceRules
Optional. The communication service handler rules for this account. The CommunicationServiceRules dictionary currently contains only a DefaultServiceHandlers key; its value is a dictionary which contains an AudioCall key whose value is a string containing the bundle identifier for the default application that handles audio calls made to contacts from this account.
*Thread Reply:* Thanks @NicolasR, totally missed that one! 🙈👍:skintone2:
*Thread Reply:* Thought that the option was only removed when an Echange mail was configured.
*Thread Reply:* Nope, can’t find it on all of my iOS devices - seems they removed it
*Thread Reply:* Sucks if I need to test an app that needs to be kept in the foreground
*Thread Reply:* Typical of Apple - I’m going to open a case
*Thread Reply:* I still have that option "Never" in "Automatic lock".
*Thread Reply:* Ok I’ll double check we haven’t set a restriction for this
*Thread Reply:* Settings > Display & Brightness > Auto-Lock > Never
*Thread Reply:* Yeah I don’t see that option
*Thread Reply:* Then there must be something configured or installed(policies/restrictions) that blocks that option
*Thread Reply:* Yep that’s my thinking - checking now
*Thread Reply:* Probably a reason for it security wise
*Thread Reply:* Yep iOS passcode profile set to 5 mins 🤦♂️
*Thread Reply:* It’s a pretty simple app, and we are looking to add some BLE (Bluetooth Low Energy) and proximity features. Experience with those systems would be ideal. But in general a solid developer would be great, for approx 1 month part time.
*Thread Reply:* @aaron I’ve got a guy. @jj Need to see if he’s got any availability
*Thread Reply:* what do you mean by similar to native mail app?
*Thread Reply:* With the Modern Authentication option within the Exchange config where you can authenticate against an idP (OAuth). Not sure if this can also be done with Jabber on iOS
*Thread Reply:* you can use federation and any SAML based SSO with Jabber so yes you can auth agains other IDP
*Thread Reply:* We had an issue with one of our customers, where smartgroups were not applied to newly registered devices. The issue was solved by an update of the system.
Manual workaround that worked for us was to open the smart group and save it again (no changes needed). This applied the smart group to all currently enrolled devices.
*Thread Reply:* You opened each smart group and just saved it again?
*Thread Reply:* Yes. Solved the issue temporarily until we implemented the upgrade.
*Thread Reply:* Is that then a system error, so a ticket with VMware should be openend? We are on SaaS, so it’s a bit difficult to update by ourselves, especially since we just received the last update yesterday or so.
*Thread Reply:* It was a system error on our system (on-prem), so I would suggest to open a ticket with VMware.
*Thread Reply:* usually on-prem this is a hanging Smart Group Service or maybe even crashed
*Thread Reply:* Read it in the documentation, but since we are SaaS I assume there is nothing we can do except from opening a ticket right?
*Thread Reply:* Do you have access to the device? Maybe it’s on but locked. In which case it would not report much information since its locked. It would respond but iOS limits information when locked.
*Thread Reply:* I currently don’t have a device that I could check immediately, but data samples that are over a month old because of the device being locked every now and then?🤔
*Thread Reply:* check in intervals are scheduled by your server, if the scheduled check in happens when locked, then yes it would not give much info. I have people that plug the device in, drop it in a drawer and never pull it out. It checks in, but never gives much info beyond that.
*Thread Reply:* Does this help? https://support.apple.com/en-us/HT209084#122
*Thread Reply:* Is removal allowed in the profile it is configured with or is it manually configured?
*Thread Reply:* the only reference I can see to accounts is over in restrictions and I think it refers to modifying the APPLE ID itself
*Thread Reply:* @Konstantinos Leivadaros this is great info https://support.apple.com/en-ca/HT209599
*Thread Reply:* but I don't see any changes that would account for what we are seeing
*Thread Reply:* I found a device on 12.1.4 and its missing "Remove" as well, so maybe not a new issue?
*Thread Reply:* I don't know if the "remove" option is available for mailboxes provisioned by MDM / EMM.
*Thread Reply:* You are actually adding and removing a profile which configures the email account so the question really is if you have allowed the removal of the profile configuring the email account. You can find this in the “General” tab of the profile
*Thread Reply:* ...And usually MDM profile removal requires removing them all, I've not seen iOS to allow a piecemeal removal of profiles.
*Thread Reply:* Send a picture of the “General” tab of your email profile
*Thread Reply:* Sorry, I am not in front of an AW console so trying to remember by heart
*Thread Reply:* I don't have a device with an old enough OS to capture, found this in an image search
*Thread Reply:* @Andrew Olpin we have a separate device profile just for exchange so we can remove just it or update restrictions without impacting a users mailbox
*Thread Reply:* WS1 best practices was always to use separate profiles for each functionality so Exchange profile really is best on its own
*Thread Reply:* @Lukasz is right. Never combine payloads unless absolutely necessary (i.e. Wi-Fi & Credentials).
*Thread Reply:* @David F it is not possible (and never was) to remove an exchange account on the device with the "Delete Account" option, if it was pushed through an MDM. The option is only shown for manually added accounts.
In case anyone has any idea or has seen this behaviour: https://mobilxperts.slack.com/archives/C7MF5T6KH/p1555343907002600 🤔
}
*Thread Reply:* Ran the scenario on a device and couldn’t reproduce - is this happening across iOS versions?
*Thread Reply:* Most of our users are on iOS 12. It happened to me and a few of my colleagues. MSFT told me the issue needs to happen live in order to find the root cause
*Thread Reply:* Chinese government is watching you 😂
*Thread Reply:* That’s not going to be easy unless they put debug logging on the servers in the cloud and on all the clients which I highly doubt
*Thread Reply:* By the way it happened to me with Thai characters with O365+native macOS client
*Thread Reply:* Never complained because my company didn’t support officially macOS native client :-D
*Thread Reply:* We only use the outlook mobile client - never used the native client.
*Thread Reply:* I remember I searched for something similar a while ago, but did not find anything in this regards. I am pleased to see such an article existed, and disappointed to see it was already removed before I could use it.
*Thread Reply:* These are not the pages you're looking for.. Move along 🤖
*Thread Reply:* Interesting though because I have similar problems and this would be really great to have.. Will check archive.org
*Thread Reply:* Indeed.. Apple must have a robots.txt blocking them
*Thread Reply:* Apparently the cache worked at some point in the past: https://www.reddit.com/r/ipad/comments/5gogol/restoring_from_an_icloud_backup_to_a_depenrolled/
*Thread Reply:* Also interesting: https://forums.ivanti.com/s/article/Transitioning-devices-into-Apple-DEP
*Thread Reply:* I found this one: https://support.datajar.co.uk/hc/en-us/articles/206944489-Restoring-user-data-after-moving-into-the-Device-Enrollment-Program
*Thread Reply:* I was looking for the same last week. Good to know I’m not crazy. Or I’m not the only crazy.
*Thread Reply:* The Wayback machine comes to the rescue: https://web.archive.org/web/20150214031317/http://support.apple.com/en-us/HT202977
*Thread Reply:* …but I don’t think this is the one you are looking for @NicolasR
*Thread Reply:* It is...!! But was searching in archive.org without success! Thanks man
*Thread Reply:* Perhaps this could be useful too: https://mobilepros.org/2019/02/ios-device-management-backup-and-restore-reference-guide/
*Thread Reply:* That only prevents the user from changing the app settings related to cellular data. APN can't be disabled in any restrictions I'm aware of disabling or restricting editing would be handled at the carrier level
*Thread Reply:* Perhaps if you set an APN via MDM this will prevent the setting from being changed? I don’t know, am just guessing.
*Thread Reply:* Currently we deploy APN via MobileIron Core, but the values still can be modified by the users. We need to switch to Cellular policy anyway because APN will be deprecated by 🍏.. maybe with Cellular policy that works. I just thought that there has been a restriction to prevent modification of mobile data settings.
*Thread Reply:* I've simply known that APNS (as a protocol) just doesn't support the model. Never seen much on why, that would be up to Apple to discern 🤷♂️
*Thread Reply:* At least with WS1, it does support proxy. But the it needs to be a Socks proxy.
*Thread Reply:* https://support.apple.com/en-us/HT203609
*Thread Reply:* ^^Thats the only article I think I’ve ever seen directly from Apple on the subject. We opened a ticket once hoping they would shed more light, but we got a pretty canned “this is expected behavior” response and they closed the ticket
*Thread Reply:* haha, that is expected Apple behavior
*Thread Reply:* From client side: iOS 12 brought support for APNS through Proxy
From server side: APNSv2 protocol might help as it is now HTTPS
*Thread Reply:* Apple is transitioning from ”binary” APNs protocol to APNs2 which is HTTPS based. @NicolasR do you know about documentation/KB article mentioning iOS12 support for APNs over proxy support?
*Thread Reply:* ^^I’d be curious to know about that. I don’t recall seeing anything related to it in the Appleseed notes. I’ll check the iOS 12 Security Reference guide
*Thread Reply:* can’t find the document but it was something Apple announced via email to partners when iOS 12 was out
*Thread Reply:* Whats the use case here? Mobile devices on WiFi and no Data plans where WiFi is via proxy to internet?
*Thread Reply:* @Lukasz Wi-Fi only (and usually single purpose) iPads in highly restricted environments like banks/government. It is also common problem with macOS management. For example iPads used for document signing.
*Thread Reply:* We had a case like this for iPads that were being used as a mainframe interface. The network they were connected to day-to-day didn’t allow any traffic related to APNS. The solution ended up being a dedicated terminal where they could be hardwired to a connection for updates (this worked on 2 levels since the device couldn’t be connected to the external internet and the mainframe at the same time since only physical connections to either were allowed). It’ll be interesting to see if this iOS 12 stuff pans out, I still haven’t found any official documentation on it
*Thread Reply:* Yes the lack of any kind of "Apple ID Corporate" program is a big pain on this platform IMO. Even though we can cover some aspects of it through DEP (like the Activation lock) it's still quite annoying that users have to create their own account with Apple to download stuff from the app store and we can't manage it (of course VPP is an option but it requires going outside the apple ecosystem with a private store if you want to do it on-demand)
*Thread Reply:* I really hope ABM is a move towards my AD user accounts becoming managed Apple ID's
Interesting article. Many (all?) of these parental control apps were using supervision & MDM to manage child devices. Apple seems to be cracking down on this practice now. Of course the app developers are complaining. But I don’t think they should have been using supervision in the first place. Thoughts? https://www.nytimes.com/2019/04/27/technology/apple-screen-time-trackers.html
*Thread Reply:* Also relevant: https://www.macrumors.com/2019/04/27/schiller-screen-time-crackdown-mdm/
*Thread Reply:* Benedict Evans had an interesting take, which was essentially that one person’s parental control app is another persons spying on a spouse / ex app https://twitter.com/benedictevans/status/1122305422864474113
}
Twitter
}
Twitter
*Thread Reply:* I think Phil Schiller has a good point. And I'd rather see them addressing it by blocking these apps than restricting MDM functionality 🙂
*Thread Reply:* I agree @Tycho. This just fuels the privacy fire when it comes to corporate use of MDM though.
To continue the whole MDM and parental control saga, check this out: https://medium.com/@ourpactapp/there-used-to-be-an-app-for-that-41344f61fb6f
*Thread Reply:* This is a statement from one of the vendors who’s app got pulled. One huge problem is that none of the parties involved are making the distinction between supervised and non-supervised use cases; and what happens via MDM and via their agent.
*Thread Reply:* Let’s just hope that Apple has some surprises in store at WWDC for BYOD and parental controls
*Thread Reply:* They also confusingly claim multiple times that Apple invented MDM technology
*Thread Reply:* The comments made through Apple’s media and Phil himself are blatantly not true unless Apple themselves have found a flaw or flaws that open up access to MDM controlled devices to unknown sources. This is going to continue to muddy the waters of MDM and make it more difficult to get the truth out about this protocol and services that depend on it. I’d like to see the security research that Phil references in his comments.
*Thread Reply:* I think Apple was talking about cases where somebody gets social-engineered into installing malicious profiles or enrolling in MDM controlled by a malicious party.
*Thread Reply:* Yes, I’m sure they were. But the broad nature of the statement doesn’t specifically address those “bad actors”. Nonetheless, they should share their security research so that these “good actors” know what to avoid and thus be allowed to maintain their livelihood. This just seems so heavy handed and without warning, that it seems like a security breach announcement would be next.
*Thread Reply:* So I tried several things, the only thing that actually worked, was logging in with an Apple ID while enrolling the device so I could accept the terms and conditions, which possibly led to the installation of the apps. But that doesn’t make sense, because I’m trying to do VPP because I want people to be able to enroll without Apple ID. I’ll open a ticket with WS1, just to see if they can help with the issue, even though this sounds like an Apple issue.
*Thread Reply:* Make sure you've configured the app with device based VPP, not user based VPP
*Thread Reply:* https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/9.6/vmware-airwatch-guides-96/GUID-AW96-MD_DvcBsd_Ovrvw.html
*Thread Reply:* In case you've ever had a click-happy admin who decides to get a little crazy before you get into the screen-share... even revoking a production APNS cert, then renewing, will not force a re-enroll of all devices. I called Apple right after I noticed he did this, and eventually a tier 3 engineer called me back and said we were basically screwed and would need to re-enroll 1250 devices. Within 24 hours, the cert would be on the revocation list, and that would be that. We're now in hour 28, and no issues. I feel like the more I learn about this, the less I know. It appears that as long as the cert topic is the same, it really doesn't matter.
*Thread Reply:* I believe the device needs to be able to reach certificate revocation servers, so iOS can check the validity of the app signing certificate. This needs to be done at first launch, and every few days after. I’m not sure of the address, it could be ocsp.apple.com.
*Thread Reply:* The article you linked to mentions https://ppq.apple.com
*Thread Reply:* Thank you Aaron, yes I see that on the end of it, but I was wondering if there are more details in regards to ports. I know Apple uses 17.0.0.0/8, but other details would be helpful. Maybe this would be a question we would need Apple to answer.
*Thread Reply:* Try this one : SecureContact X Business https://itunes.apple.com/de/app/securecontact-x-business/id1450074955?mt=8
Secure „offline“ Storage for GAL Contacts. For trial Version please Send me a Message
*Thread Reply:* Apple has no interface to disable “auto brightness” over the air. So AirWatch and other MDMs can not control this. However the setting is saved with backup and restore. If you restore a backup as part of your provisioning process, you can disable auto brightness, and set brightness to whatever level you want. You can use a tool like Configurator or #groundcontrol for this.
*Thread Reply:* Oauth is just authentication, powershell is after the fact to add/remove authorization to sync. So they are independent of each other.
If rumours are to be believed, then models such as the iPhone 6 Plus will no longer be supported when iOS 13 lands, any truth to this: https://www.macrumors.com/2019/05/10/ios-13-drops-iphone-6-iphone-5s-iphone-se-rumor/amp/
https://developer.apple.com/videos/play/wwdc2019/303/ FRIDAY 12pm MST - Apple MDM Webinar - hopefully they'll dig deep into what exactly everything we saw earlier will look like
*Thread Reply:* To be clear, this session is coming on Friday. They will have a lot to cover in one hour. Not sure how that will work.
*Thread Reply:* Yeah I was just going to say, this is on Friday. They'll probably post the video only after (not livestreamed). It is a lot of course but I think they'll just give an overview and give links to the actual docs where we can deep dive.
*Thread Reply:* * user-enrolled MDM (the new BYOD) * data separation * managed Apple IDs * “modern authentication” for DEP enrollment (and elsewhere?) * SSO Extension (?) * New rules regarding MDM use by third parties * iPadOS (of course that’s aimed at businesses) * activation lock for Mac ** iCloud for Enterprise
*Thread Reply:* Thank you guys! Forgot to mention the actual date -_-
*Thread Reply:* No guarantees when it will be actually ready to use either, based on past experiences
*Thread Reply:* There is also an interesting session today, but no idea if there will be a video after the session. Edit: It's just a meeting. Perhaps something will come out. Waiting for Friday!
*Thread Reply:* Here are the sessions I’m looking forward to: • https://developer.apple.com/videos/play/wwdc2019/303/ • https://developer.apple.com/videos/play/wwdc2019/304/ • https://developer.apple.com/videos/play/wwdc2019/504/
*Thread Reply:* Nice!! I didn't realise FIDO2 was coming
*Thread Reply:* Livestream just ended, was pretty cool.
*Thread Reply:* I've access now as well
*Thread Reply:* I cannot believe that would actually be brought up, maybe the fact they can copy all the data on the device as can anyone taking advantage of the security hole that a jailbreak is. Basically assume anything safe to have on a jailbroken device can be posted on the internet including live microphone camera and location feeds. If they are okay with that then it may be acceptable. If you want official statements I would check the IOS security guide from Apple
*Thread Reply:* With mobile operating systems, much of the security is based on the operating system controls. It keeps the credentials for authentication, wifi login information, passwords, etc. If the device gets jailbroken, it's light years easier to get access to that.
additionally, these devices have lots of sensors and go with us everywhere. If your CEO is driving to the HQ of a competitor planning a buyout, that may be information that could come under the jurisdiction of the SEC.
*Thread Reply:* There is also no guarantee that any MDM controls you apply would be enforced.
*Thread Reply:* The jailbreak may expose the encryption key in plain text as well.
*Thread Reply:* I agree with @DirkC on these points, I would also asked what their posture is for iOS updates as a whole. I have found the jailbreaks are becoming harder and harder with newer releases of iOS. I find most organizations require or at least recommend users be on a certain iOS update to ensure patches to vulnerabilities and bugs. Most jailbreaks are a few versions behind that which means they are already exposing themselves to security vulnerabilities. Just my two cents 🙂
*Thread Reply:* It is so sad you even have to do this. Device is compromised end of story.
*Thread Reply:* if something like KeyRaider exist today that’s the only argument you need to have in your arsenal
*Thread Reply:* If the Watch is not managed it shouldn’t show the contact names, AFAIK. If you want that to show, you could try to enable “Allow managed apps to write contacts to unmanaged contacts accounts”. Even though I wouldn’t, if the Watch is not under management.
*Thread Reply:* @Julio good suggestion. However, watches can’t me Managed (or unmanaged) because Apple hasn’t provided that framework
*Thread Reply:* What’s odd here is that it usually works but randomly will stop working
*Thread Reply:* Depends on what you are looking to do. iOS does support SMIME https://support.apple.com/en-in/HT202345
*Thread Reply:* Thats useful. Thank you Jay.
*Thread Reply:* I created this iOS backup/restore guide based on iOS 12 (I'll update it if anything changes with 13): https://mobilepros.org/2019/02/ios-device-management-backup-and-restore-reference-guide/
*Thread Reply:* The use case I have is, it’s a bunch of kiosk devices and I want to update them building by building, so I was thinking of applying it to all and then start with a small group of devices, by just triggering the update anyway. Which would keep the rest that was not triggered in the delayed mode. Probably it might make sense to create a profile just for that purpose and excluding the ones I want to update on the planned day right?
*Thread Reply:* You cannot update by profile you can by compliance policy be sure to pull the devices out of single app mode before sending the update if you were doing that, excluding the ones you want to update should work, I have never tried to push an update through a block so you may test if you need to it would probably be wise to remove the block regardless
*Thread Reply:* Thanks for the feedback. Have you tested that scenario already?
*Thread Reply:* Also only applies to OTA updates, so iTunes or Configurator installed updates should circumvent
*Thread Reply:* @Andrew Montague Check you Single Sign-On profile that it contains bunde ids of Google apps.
*Thread Reply:* Thanks, it does have them. Good call though.
Interesting: https://www.macrumors.com/2019/07/23/iphone-to-iphone-data-migration/
*Thread Reply:* I don't see how cellular radios would impact a WiFi only deployment.
*Thread Reply:* We do a LOT of work with clinical communications iPhones, and I’ve never heard about this one. With no SIMs, the cellular portion is irrelevant. So I agree with your skepticism.
*Thread Reply:* Dual SIM is interesting for having multiple phone numbers, but it doesn't really have anything to do with managing the device. There's still only one operating system, and any personal vs. corporate apps are still managed by the MDM configuration on the device.
*Thread Reply:* kind of. if it's a corporate device and users are allowed to add their personal phone numbers, it's essentially a COPE device, which absolutely impacts the management, depending on how you interpret this.
*Thread Reply:* COPE devices, per NIST guidelines, should be treated as a fully fledged personal device in regards to app management. That means no blacklisting.
*Thread Reply:* There's also issues with cross pollination of contacts, right?
*Thread Reply:* There's always issue with cross pollination of contact if you allow personal apps and contacts, but that's mostly a question of how you handle the device. For most companies, whether personal or corporate owned, the user is allowed to install whatever applications they want, so the added SIM doesn't alter much. You have to figure out your containerization plan and what your requirements are for locking down the device.
*Thread Reply:* virtually every one of my clients for the past 5 years has blacklisted some kind of app or another
*Thread Reply:* From my POV, I don't care if a user adds their personal phone to a corporate device, they're still not going to get to download Netflix, dating apps, etc.
*Thread Reply:* Hi Justin, that sounds like an interesting case, but I totally agree with your last point. The fact that they add a personal SIM to a corporate device does not make it a personal phone. They can use SMS, and phone calls from their personal SIM, but app blacklist and policies should remain as per a corporate device.
*Thread Reply:* That‘s the way we implemented it in our company. But to be honest: our blacklist is short (Outlook mobile & Whatsapp)
*Thread Reply:* your best bet is to read the below support article. I've been told this includes iPadOS also.
https://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000057712
*Thread Reply:* Nice Thanks. BB will not develop an own ipados Version for the BD SDK for now it seemed. lets see.
*Thread Reply:* I've been keeping an eye out on the numbers since the exploit is back in the wild but we really don't see any except for a few folks that do it on purpose to make homebrew apps work.
*Thread Reply:* Basic hardening should prevent jailbreaks, e.g. block users from installing enterprise apps, block users from installing config profiles….
*Thread Reply:* Possibly block USB-host connections for extra hurdle
*Thread Reply:* We block them immediately if they try... Agree with @Thomas B. but of course with BYOD there's limited option to do this.
*Thread Reply:* @Tycho what are you relying on it to detect the jailbreak?
*Thread Reply:* WS1 built in detection. Not sure how good it is though
*Thread Reply:* user enrollment is already here but requires EMM to enable it
*Thread Reply:* Gotcha. thanks @NicolasR - have you tried it?
When will MI Core target these new features? If this container feature is only relevant for user enrollment, I am asking myself if we want to enroll our company owned devices with user enrollment only because of that feature. Wipe devices is history then as far as I know.
*Thread Reply:* MobileIron do not support it yet. Not sure about workspace one?
*Thread Reply:* MobileIron is working on it and large customers already asked this for support in CORE/CLOUD. I guess it will come around CORE 10.5 or 10.6 (Q3/Q4 2019) *put the appropriate disclaimer here* 😉
*Thread Reply:* I read somewhere Intune was going to have support very soon. Anyone know if it’s out?
*Thread Reply:* SOTI’s mobicontrol will have support for user enrollment in the next release.
*Thread Reply:* Workspace ONE Getting Ready for Apple Fall 2019 Releases
https://support.workspaceone.com/articles/360024561354
There's a nice little section in here on what can and can't be done with User Enrollment and a video showing the enrollment process.
*Thread Reply:* Very useful link - I wish MobileIron would have similar content with these kind of info and videos!
*Thread Reply:* Tested. "Will this remove the need to choose certificate etc?" = NO 🙂
*Thread Reply:* You have to chose the cert in the exchange profile as well
*Thread Reply:* Also are you using a system that needs both a cert and Oauth since if you are doing cert based you do not use Oauth
*Thread Reply:* No as Modern authentication is handled in Safari. It will work automatically only with CBA against Azure AD.
*Thread Reply:* 👍 Just need to work out if possible 😁, research time....
*Thread Reply:* Which EMM? If you are using Workspace ONE Access then shortcuts can be configured in the catalog.
*Thread Reply:* Hi @Andrew Montague Interesting. This looks like more of a webclip sort of approach though, so wouldn’t necessarily be a catalogue of shortcuts (workflows)? Not sure it would also get through versioning limitations as well so if e.g I changed a workflow to include another variable (as an example) user would still have their existing configured workflow in the app. We are also WSO customers though so if I’m missing something here this would be good
*Thread Reply:* Apple has a program called AppleSeed for IT which provides enterprise related features, beta profiles for download and also includes test plans that can be used to verify new features
*Thread Reply:* https://appleseed.apple.com/sp/welcome
*Thread Reply:* We have been using AppleSeed since it got added to ABM
*Thread Reply:* I was looking more for callouts to new MDM functionality
*Thread Reply:* VMWare has basically told us that we have to export our device profiles before and after they seed new models and figure it out on our own what's changed
*Thread Reply:* Well… https://mobilepros.org/2019/06/wwdc19-enterprise-a-palooza/
*Thread Reply:* right, I saw this a while back, fantastic resource by the way
*Thread Reply:* like, I think I care share this here, the Today View kind of caught us off guard. The PI exposure initially was a bit scary and it was not immediately discernible how we could control it.
*Thread Reply:* The Today View can be disabled on the lock screen. That’s been available in MDM for a few years.
*Thread Reply:* no I know, we were hoping for some granular redaction and ultimately never found it
*Thread Reply:* In Canada, touching a cellphone in car is an immediate ticket, so we haev to balance the PI exposure and usability
*Thread Reply:* @aaron Do you know if it will be possible to use the managed AppleID in combination with Automated Device Enrollment?
*Thread Reply:* So you mean enroll as AD user but use managed Apple ID for iCloud, etc? I am not sure. It isn’t obvious that anything other than “user enrollments” devices allow two Apple IDs. No partition, so no data separation.
*Thread Reply:* The more I think about it, the more I think only UE devices will allow 2 Apple IDs. I can’t see Apple adding a user interface for a “company Apple ID” within the OS.
Now if you want to use a managed Apple ID as the one and only Apple ID on a DEP device, that’s probably fine.
User Enrollment isn’t coming until Sept 30 BTW. And it will need to be supported by MDM.
https://www.apple.com/ios/ios-13/
https://www.apple.com/ios/ios-13/features/ has user enrollment with a ** which notates Sept 30th
*Thread Reply:* No Jony Ive lulling us gently to sleep
*Thread Reply:* This sums up every Apple event basically 😉
*Thread Reply:* I was expecting a tracker too
*Thread Reply:* I'm disappointed that Apple Arcade isn't an actual arcade machine
*Thread Reply:* But it is still good for mobile gamers
*Thread Reply:* ya, I wasn't looking for more reasons for my family to stare at their screens, thanks Apple 👍
*Thread Reply:* Frogger was the headliner game.....sad business
*Thread Reply:* It does. Running 13.1 on my iPad Pro
*Thread Reply:* Interesting. First time I hear of it! Might you have access to the document that list this known issue?
*Thread Reply:* @Wolfgang Bauer yes, we recommend to our customers to wait for 13.1
*Thread Reply:* There is no document for it. You need to test it for yourself to verify.
*Thread Reply:* My mail client with exchange server is completely broken. I’m not getting any emails and the app is completely empty apart from the folder list.
*Thread Reply:* What certs are you running on your Exchange servers? Are they compliant with Apple’s requirements? See: https://support.apple.com/en-us/HT210176
*Thread Reply:* Yes it’s compatible. Was working during all the betas and working with iOS 13.1 betas. Seems to only be broken in the GM
*Thread Reply:* Yeah… 13.1 beta 3 is pretty solid. 13 GM is still a mess. Avoid it if possible and wait till 30.9. for 13.1
*Thread Reply:* According to some forums, I’m not the only one to have issue with exchange on 13 GM. Wonder if they’ll end up releasing it with broken exchange
*Thread Reply:* upgraded the same device to 13.1 Beta 3 and Exchange is now working
*Thread Reply:* anyone using a defer update policy for this? What do you guys do at release of 13.1? Push the iOS Version manually to the devices?
*Thread Reply:* interesting the release notes stated that it was fixed in Beta 6
*Thread Reply:* (iOS 13 Beta 6) The allowOpenFromManagedToUnmanaged restriction prevents saving files from managed apps to the local Downloads folder, which is unmanaged.
*Thread Reply:* Interesting. I am not able to test it now (all my test devices running 13.1 betas). Is someone else able to test and confirm?
New video! https://developer.apple.com/videos/play/tech-talks/301/
*Thread Reply:* You can push native account, but Google apps don’t support app config
*Thread Reply:* Google apps can use this native account after if i’m not wrong
*Thread Reply:* Unfortunately I don't know MobileIron but I do know that in Workspace ONE if the device is enrolled using AfW GMail is considered the 'native' mail client and can be configured by a native mail profile.
*Thread Reply:* Jean-marc is talking about iOS. No way to configure Gmail app this way on iOS.
*Thread Reply:* We were told by Apple that they will try to get as many companies as possible OUT of the Enterprise Developer program. They encourage everyone to start using Custom Apps in Apple Business Manager.
*Thread Reply:* Been slow with no explanations. Even did a few screening calls.
*Thread Reply:* @Boe No shaming. It won't cause any issues. We made the switch too and all of our apps populated in the new ABM portal.
*Thread Reply:* Thanks @Ray Domingue I appreciate the quick response. Also the shamming was meant to be in good fun after all giving someone a hard time hear and their builds character 😄 or so they say
*Thread Reply:* @Ray Domingue did it take a little while for all your apps to populate? I just took the plunge and turned it on and I'm not seeing any of my old apps yet
*Thread Reply:* its just classed as a "migration" so it should retain all existing apps just in the new portal. One thing to make sure is the locations setup in ABM and also if you use VPP Purchasing agents. good article is https://support.apple.com/en-gb/HT208817
*Thread Reply:* Thanks everybody iOS is by far our biggest use case so wanted to make sure before taking the plunge. I love how fast everyone response in here far more efficient then reaching out to support 😄
*Thread Reply:* "I love how fast everyone response in here far more efficient then reaching out to support" Wait ... Apple offers support? 🤣
https://twitter.com/axi0mx/status/1177542201670168576?s=21
}
Twitter
*Thread Reply:* Source: https://twitter.com/morpheus______/status/1177574298791370752?s=21
}
62657156686f6a75636a4d21506a736699a0f1548b
(https://twitter.com/Morpheus______/status/1177574298791370752)
Twitter
*Thread Reply:* I bet Android would run lovely on their hardware.
*Thread Reply:* It is bad but maybe not that bad how it looked at the beginning - see comment #168 - https://forums.macrumors.com/threads/checkm8-exploit-opens-door-to-unpatchable-jailbreak-on-iphone-4s-through-iphone-x.2202080/page-7#post-27815808
*Thread Reply:* Some things you mention are only possible once they're actually developed though (e.g. an Android build that can run on such hardware). iOS versions should indeed work.
Also be aware that if you turn it off you have to DFU it to boot again, since the boot rom can't be modified. This exploit is not persistent so it has to be applied on every boot.
By the way as I understand it brute forcing the password/PIN is not possible because the secure element will enforce a number of attempts (10 AFAIK).
*Thread Reply:* secure enclave is not compromised AFAIK so data will still be encrypted and brute force of creds not possible. Any jailbreak should still be detected by MDM or MTD in theory so from a corporate data point of view this should not be a high risk item. Obviously monitor closely though as its still very new and be very wary letting your device out of your sight or plugging it into an unknown lightning cable!
*Thread Reply:* This is what I understood as well
*Thread Reply:* If you dont have them enrolled my guess is that you need to do them by hand. Quickest would be to have an USB-hub and connect the devices to Apple Configurator and do a few at a time.
*Thread Reply:* yeah thought this might be the only way, was hoping someone had a miracle solution as there is about 800 iPads that need updating
*Thread Reply:* ^^yes this! I'm not sure you have any other option really
*Thread Reply:* Oh, and set up an Apple Caching server as that will speed up the process a LOT!
*Thread Reply:* GroundControl can do it, if you are willing to do a paid option. Want to reach out?
*Thread Reply:* The customer was about to pay for some temps to come in and do this so paid for option is definitely something they will consider.
*Thread Reply:* If you have a Mac, you can install Configurator for free from the store and then hook up as many devices as there are USB ports available and select all - update
*Thread Reply:* Does anyone here use Apple’s iWork apps in their org? If not, what is the most effective way you’ve seen iPad be a useful productivity tool in your office?
*Thread Reply:* Office is a very narrow subset of where mobile devices can be used. There are some great examples on apple.com/business/ from companies across health, industry, transport and construction where iPad is used way beyond the traditional ‘office’ use-cases.
*Thread Reply:* https://www.ben-evans.com/benedictevans/2019/9/27/new-productivity
*Thread Reply:* i have done work like this for clients. my approach is to do a user persona modelling discovery first i.e. workshops, interviews, surveys with end users to find out what their current workflow looks like and where they think it could be improved. usually end up with 6-8 personas and then i analyse these for opportunities for mobile tooling. typically field workers and data consumers/presenters (think sales reps for example) are good candidates for using tablets and mobile apps. if you have a good BA or BA skills it helps 🙂
*Thread Reply:* have you invented a time machine? 😉
*Thread Reply:* Maybe there will be some sort of Moore’s law for iOS updates now? The number of iOS updates will double every year/quarter?
*Thread Reply:* ...while the battery life is reduced by 2 every month? 😆
*Thread Reply:* Could not find anything either. Whois is up for creating accounts the manual way ?
*Thread Reply:* I'm also eagerly waiting and kind of dreading the moment.. see someone requested staff to be using Apple ID registered with their corporate email - I'll have a lot to explain about conflicts and why they should start changing their existing IDs
*Thread Reply:* Yes we are going to have the exact same issue! It would be nice if Apple could provide a list of users that are using their corporate address currently!
*Thread Reply:* There's also the open question on what happens if users have existing "personal" AppleID's with a corporate email address
*Thread Reply:* For Apple School Manager, which already has federation, the docs state: Note that standard Apple IDs cannot be converted to Managed Apple IDs.
Assuming that ABM will work similar to ASM, this could lead to some serious headache.
Maybe you need to create managed IDs like <a href="mailto:john.doe.appleid@company.com">john.doe.appleid@company.com</a> to prevent collisions. But that's just guessing 🙂
*Thread Reply:* So bring me up to speed - the use of managed Apple IDs created with the ABM is only relevant for User Enrollment?
*Thread Reply:* @Damian, ASM shows you the conflicts when federation is configured. https://support.apple.com/en-gb/guide/apple-school-manager/apde685676ac/1/web/1 @Tobias, I believe ABM will work like ASM with regards to federation, which means users will get notifications to change the email address used as personal Apple ID (work email address in our case) to something else, or Apple will automatically rename it in 60 days. https://support.apple.com/en-gb/guide/apple-school-manager/apd3bfda7748/1/web/1
*Thread Reply:* @MichaelM21 Currently managed Apple IDs in ABM are only used for assigning administrative roles inside of ABM itself. As soon as User Enrollment becomes available, managed Apple IDs will be used for that mode.
*Thread Reply:* Sure it can be device-based VPP if you like. Or user-based. Your choice.
*Thread Reply:* with the new user enrollment?
*Thread Reply:* I believe so. Why not? Just because there is a Managed Apple ID shouldn’t force you to use user-based app assignment. Device-based offers several advantages.
*Thread Reply:* I know, just currently messing around with WS1 and I agree with you on it should but apparently it doesn't 100% want to do stuff - currently assumg it is WS1 as I can see the App then automaticly gets the user assignment though device based is activate it just wont push
*Thread Reply:* so it is potentially that or the used vpp token must match the MAIDs location within ABM - documentation, at the least the one I can find, is pretty slim
*Thread Reply:* I admit I haven’t tested. But if MAIDs did require user-based app assignment, that would cause problems when trying to use the same app for, say, shared devices with no Apple ID.
*Thread Reply:* User Enrollment does not work with device based vpp. only user licensing.
*Thread Reply:* you can block it via package name. Some MDM can also remove it via a setting
*Thread Reply:* Thanks Marc,any idea how to remove this via Mobileiron MDM.The issue i am facing is when a user receives an digitally protected attachment via native mail,upon tapping download,it becomes blank.Hence i am trying to fix this by disabling the automatic opening in the native browser.
*Thread Reply:* Thanks. Don’t know why my search didn’t return that. Searching “Find My” is just a PITA
*Thread Reply:* https://github.com/joeblau/apple-bundle-identifiers
New iOS version, again... https://www.macrumors.com/2019/10/15/ios-13-1-3-released/
*Thread Reply:* Hi Duncan, let’s plan a call.
*Thread Reply:* Hoi Duncan! Nice to see you here also! It’s no problem to connect from multiple locations with Apple Configurator. I advice to use multiple accounts for that for monitoring and 2FA. But yes, it’s a lot of work.
*Thread Reply:* Nothing in the configuration payload documentation that suggests it is possible, so I do not think so.
*Thread Reply:* Yeah, I can’t find anything either. But I was hoping for some unpublished XML
*Thread Reply:* iPads aren’t desktops. The UserAgent is updated as macOS when this is enabled.
*Thread Reply:* Plus the only option is “All Websites”. Can’t I at least reference which ones I want in “Desktop Mode”? This isn’t Microsoft Edge.
*Thread Reply:* Thinking I might try a URLScheme to launch the Settings app to that area and work with folks to toggle it off. 🤷♂️
*Thread Reply:* Safari ⇾ Request Desktop Website: prefs:root=SAFARI&path=Request%20Desktop%20Website
*Thread Reply:* I thought there used to be the ability to push a restriction based on app rating, but that may be deprecated.
*Thread Reply:* You could put something like Wandera on there and use it's categorisation capabilities. They could download a gambling app but not use it or access it via a browser
*Thread Reply:* not the best UX but would achieve your goal i think
*Thread Reply:* Draft sync was added by MS in ActiveSync 16 (Exchange 2016) and enabled for iOS with 10 - https://support.apple.com/en-us/HT202803, So, if you've been running 2016, you should have had it for a few years now.
*Thread Reply:* If you are still on Exchange 2013, there is an additional issue with drafts disappearing from the drafts folder in 13.x, which is fixed with 13.2.
*Thread Reply:* @JmB I created another location in ABM and allocated liceneses to that new location. i.e. your 50k you could split it up to 25k to your location and the other 25k to another location you set in ABM. That way in your MDM/UEM you'll see 25k allocated while the other 25k are "hidden". Hope that helps.
*Thread Reply:* I don’t know if it’s possible. Y+ou could transfer them to another entity/environment...
*Thread Reply:* With Business Manager or School Manager you could create a new location and transfer some licenses to that other location "Trash location"
*Thread Reply:* Yeah, I have a location called VPP Parking Lot and move licensing there when it’s no longer needed or the app is no longer available.
*Thread Reply:* Holy crap great idea guys this has drove me nuts for awhile now never thought about doing this but will be implementing it shortly 😄
*Thread Reply:* @Dimi You're backing it up via iCloud?
*Thread Reply:* Nothing is set in stone , I need to come up with a process that would allow me to to transfer user data (contacts, photos, personal apps, etc) when I migrate devices from BB UEM to Intune.
*Thread Reply:* Why don‘t you just retire the device in BB UEM and enroll it to Intune? The device is still supervised. Disadvantage is that the user can remove the MDM profile. If you can live with that, I would prefer it.
*Thread Reply:* @Nico Hermeling I need a device to be DEP enrolled and Supervised. I believe factory reset is the only way to achieve this.
*Thread Reply:* surely it wont be supervised if you enroll it to Intune without DEP.
*Thread Reply:* It is still supervised. We‘re using this way for our migration projects
*Thread Reply:* After enrollment, the only way to turn on supervised mode is to connect an iOS device to a Mac and use the Apple Configurator (which will reset the device). You can’t configure a device for Supervised mode in Intune after enrollment.
*Thread Reply:* https://docs.microsoft.com/en-us/intune/remote-actions/device-supervised-mode#turn-on-supervised-mode-after-enrollment
*Thread Reply:* Here is the expected behavior (tested up to iOS 12, but I don’t believe this has changed in iOS 13): https://mobilepros.org/2019/02/ios-device-management-backup-and-restore-reference-guide/
*Thread Reply:* @Nico Hermeling you saying the documentation is incorrect or am I missing something.
*Thread Reply:* Check it out on your own. If the device was supervised in BB and you just retire it there, it is still supervised
*Thread Reply:* If you back up a device with no management profile or a management profile from another MDM, then wipe it, DEP enroll it in to a new MDM and allow for them to restore previously mentioned backup, the device will not be properly managed.
As mentioned above, it’s probably just better to remove management without resetting the device and manually via Safari or AC enroll in to the new service.
The supervision will remain in the BB name, but that won’t impact management
*Thread Reply:* We tried doing this (DEP migraton without factory reset) 2 weeks ago but it's very hit & miss. Sometimes devices show as enrolled but no profiles are there. Other times we get profile installation failed. Sometimes they work OK.
But overall it was hit & miss unfortunately. This was from Workspace ONE to Intune.
*Thread Reply:* By the way the backup/restore method did work consistently but only if you don't do the restore during the setup wizard.
*Thread Reply:* @Tycho Does it tries to restore MDM profile and apps deployed via previous MDM?
*Thread Reply:* Yes it does if you do it during the setup wizard. It broke the intune process (which uses the guided mode)
*Thread Reply:* I didn't test this last bit out myself but this is what my colleagues told me
*Thread Reply:* If you do an icloud restore/iTunes restore from a device to a device with the same serial # is when you run in to trouble
*Thread Reply:* Yes, if you take a device managed by BB and back it up while managed, then reset that same device, enroll it via DEP to intune, but restore from that iCloud backup during the activation assistant, it will not be managed by inTune. If you restore that same back up to any other device, it will be managed by intune
*Thread Reply:* It gets convoluted - here’s a chart I made
*Thread Reply:* This chart doesn’t take in to consideration moving from one service to another, but that’s the same idea as having no management profile in this scenario
*Thread Reply:* @Matthew Shaver in the article you say: the assumption is that all management profile data backups and restores are going through the same MDM/EMM/UEM service, and not during the migration from one solution to another.
*Thread Reply:* Yeah, if you are migrating you’ll still hit issues - it will either restore the old management profile or have no management profile
*Thread Reply:* The rule of thumb is to avoid restoring if the serial numbers are the same and the MDM is changing. Instead just skip restore and have iCloud backup data sync afterwards. The only big items that can’t be recovered in that workflow are SMS and voicemail history - those are only put back via a restore
*Thread Reply:* I should say this could have all changed with iOS 13. I haven’t had an opportunity to do a fresh round of testing since it launched
*Thread Reply:* would be interesting what is now the fact in iOS 13
*Thread Reply:* It is still the same. DEP enrolment only works if you restore to another device. If you restore to the same device it restores the profile of a previous MDM.
*Thread Reply:* What we have started doing is deleting the device from the old MDM, then making a backup. The deletion removes the profile and then you can safely restore it.
It's a total PITA though 🙂
*Thread Reply:* @Matthew Shaver @Tycho do you know if this is it Intune specific issue or will apply to any MDM.
*Thread Reply:* It would also impact the same MDM if the device were moved from one APNS managed instance to another
Just an FYI for anyone who might not have seen this yet https://www.theverge.com/2019/10/31/20942043/apple-ios-13-iphone-11-pro-ram-memory-management-app-background-refresh
*Thread Reply:* I’m sure they’ll fix it in 13.1.9 which will be out 10 hours after 13.1.8
*Thread Reply:* I’m still catching up on the freshly released 10.3.4
*Thread Reply:* anyone else catch that someone developed something for iOS that keeps location tracking alive persistently despite the background app being killed?
*Thread Reply:* We're seeing this on ManageEngine...app is killed, hasn't been opened in a day at least and it's still reliably reporting locations up to date, I've never had reliable iOS location trails from any other MDM. Anyone know anything about new dev functions for location ased tracking in recent iOS updates?
*Thread Reply:* Hmmm....I know we (Lookout) use the network helper to automatically wake our app up whenever the device moves or changes networks (VPN, wifi, cell, etc). It's fairly solid.
*Thread Reply:* ^That's interesting - I wasn't aware of that functionality
*Thread Reply:* @Andrew Olpin Didn’t the MobileIron client used to use location changes to keep their apps alive as well? It’s been awhile, but that’s what I remember them actually needing location services to accomplish.
*Thread Reply:* Yes, indeed it did. I think the difference is that the network helper allows for more than just location changes. It also includes networks changes, even if the device is stationary.
*Thread Reply:* MobileIron also changed their wakeup strategy to APNS messages. That's another option here, if the service is sending "keep awake" APNS pings.
*Thread Reply:* This is super insightful - would like to test MI out too as I'd rather present just about anything but ManageEngine to folks lol
*Thread Reply:* In MaaS360 for instance, getting accurate location info for an iOS device outside the first 24 hours of enrollment is exceedingly rare
*Thread Reply:* What, specifically, are you trying to do with the product? Is this for fleet management, or just basic back-of-house EMM?
*Thread Reply:* both really - a huge chunk of our client base is construction so fleet mgmt is a huge concern, we generally outfit them with Androids
*Thread Reply:* but some folks have already invested in iPads and deployed them
*Thread Reply:* Hmmm....I'd suggest you start with GroundControl (@aaron) and see where they can take you.
*Thread Reply:* I haven't kept up on all the ins and outs of the product, but back in my MobileIron days they were a great partner for fleet management.
*Thread Reply:* For basic MDM / EMM, I wa surprised at how much I liked Cisco's Meraki product. It doesn't have a lot of advanced features, but it was easy to use, and the user UI was solid.
*Thread Reply:* Also, a bunch of your customers may be using Microsoft Office 365, and may already have EMS licenses which include Intune. While I find intune a bit frustrating to use as an admin, for no-frills EMM it'll get the job done...and potentially with no added costs.
*Thread Reply:* Intune won't do location tracking... period
*Thread Reply:* @Paul Conaty Wait seriously?
*Thread Reply:* Yep. Lost mode only https://practical365.com/clients/mobile-devices/can-microsoft-intune-see-managed-mobile-devices/
*Thread Reply:* Back up is tricky though. It breaks DEP enrolment if you restore. You can only restore to a new device.
*Thread Reply:* There is another thread floating around with this question - seems to be impacting every solution. We've opened an Apple ticket for it, but I haven't seen any traffic on it yet
*Thread Reply:* Yeah I saw first reports coming out of InTune
*Thread Reply:* just saw our own on MaaS
*Thread Reply:* Anyone heard more on this? MI Support hasn’t been able to draw any real conclusions. Not that I expect them to at this point.
*Thread Reply:* The only workflow on which we’ve been able to reliably reproduce the behavior is utilizing the proximity setup option
*Thread Reply:* We just saw another one with a brand new AT&T Device order. Restore was attempted
*Thread Reply:* Replacing with a brand new device
*Thread Reply:* Ugh @Justin Butts. That’s gotta be frustrating for carriers
*Thread Reply:* So replacing the device is the only solution to this?
*Thread Reply:* @Sharkey I’ve not heard anything official from Apple, but it sounds like that has been the only definitive way to fix the issue at this moment.
*Thread Reply:* Ouch. Just had one reported here
*Thread Reply:* Apple told us in their “We are Investigating” response to try a factory reset. Some workflows seem to reproduce more consistently than other - I can make it happen every time I use proximity setup for example
*Thread Reply:* We don't allow restores with DEP and an itunes restore did not help. DFU doesn't help either?
*Thread Reply:* Is the user restoring a backup or using proximity setup at all?
*Thread Reply:* I'm checking with the Telecom person
*Thread Reply:* They used iTunes to try and restore. She gave him a different device. I’m picking up the problem child device next week for testing.
*Thread Reply:* I would also ask them to try activating without doing the iTunes restore. I'd bet thats the culprit
*Thread Reply:* Probably so. But they already moved on :)
*Thread Reply:* Has anyone on this thread received any updates? Just trying to find some documentation/acknowledgement from Apple that I can pass on to my customers.
*Thread Reply:* Just an acknowledgement by Apple that they’ve received numerous reports and that they are investigating.
*Thread Reply:* Yay, FYI, 13.2.3 is also experiencing this. Pandemonium ensuing... wouldn't it be wonderful if people just bought more iCloud storage space and moved on with their lives without previous iPhone backups? Just sign in people...
*Thread Reply:* Just had a 13.2.3 device go through this process without fail...
I get alot of questions from users on how to find their ABM/DEP/ORG ID (however you want to call it 🙂). To hopefully save some emails for the community, here is a video I made on how to find your orgs ABM ID and add a reseller to your ABM portal. https://youtu.be/Kif1sXJJAdE
Semi tethered Jailbreak https://checkra.in/#release
*Thread Reply:* @Woody you mean folders? Pages? Yes you can do all with home screen icon arrangement. Usually a standard EMM feature.
*Thread Reply:* @aaron Yeah - I just found it. Last time I was doing it, I was lending profile templates from Configurator. Now they’ve been added to the main list of iOS Policies in MobileIron. Crafting one now 🙂
*Thread Reply:* Keep in mind that any apps that are not listed in your profile will be pushed to the first empty space on screen. Also, web clips can’t be organized (from what I’ve seen/experienced).
*Thread Reply:* Webclips can be organized, but you will most likely need to apply custom XML unless it has been added to the MDM’s GUI.
*Thread Reply:* @DirkC - Yes sir! Current MDM (MI Core) has it included in the GUI.
*Thread Reply:* @DirkC Have you been able to get web clips organized? None of what I’ve attempted works. Could you share your success?
*Thread Reply:* The Home screen layout profile is basically a nested array of items. The web clips should be created within the profile itself to be ordered correctly.
*Thread Reply:* Oh. We can’t do that. I’ll test it out though. Thanks!
*Thread Reply:* Unfortunately web apps created by a web clip profile are not given unique identifiers 😞 Maybe Apple will make some change with a future update.
*Thread Reply:* Yup. That was why I couldn’t figure out how to do it. Makes sense when it’s in the same profile that you’d have more control.
*Thread Reply:* that seems to not work, I have a ticket open with apple to see what they say
Some interesting from Germany : https://www.comconsult-akademie.de/ios-im-unternehmen/
iOS sessions
*Thread Reply:* Use a SIM card without SIM Pin. That way, the device will connect to cellular even before it is unlocked.
*Thread Reply:* Yes, I have had success tethering it to a network cable to get around the SIM lock
*Thread Reply:* SIM Card without SIM PIN is always the easiest way to fix this
*Thread Reply:* If you knew how fast Orange work here...anything we ask takes a month to get sorted
*Thread Reply:* I’ve ordered a lightning to Ethernet cable to get around this - delivery Wednesday
*Thread Reply:* Curious if anyone is seeing this behaviour as we’ve had a few reports recently that the passcode is not working post reboot ?
*Thread Reply:* As we force passcode renewal every 90 days, Is it finally being pushed due to big? Will have to extract the logs! Hopefully not late to get them before the cable arrives
*Thread Reply:* I’ve had varying degrees of luck. Only the cellular data is supposed to be locked after the restart, and the device should be able to connect to wifi if auto join was enabled, but I have trouble getting that to work in some scenarios (such as on captive networks). There really should be some sort of connectivity option on that lock screen after reboot.
*Thread Reply:* Wi-Fi is definitely not working for us
*Thread Reply:* And it’s a saved profile with auto-join
*Thread Reply:* I think I’m going to open a case with Apple enterprise support to get the definitive word on this...was reading that since iOS 12 they might have closed this Ethernet connection option
*Thread Reply:* The problem is that the device is still in a secure lock stage after the reboot. It does not connect to wifi until the password is at least entered once. We do see it on occasion on other MDMs but typically discount it as a user error. Never had it myself. With the recent iOS release bugs and a somewhat similar snafu on MacOS however (@Jason Bayton reported one here and i had the same issue) it just might be an iOS issue
*Thread Reply:* I can reproduce that behavior in Apple Configurator too - if I use that to reset the device passcode after a reboot - the console comes up with an error that the action can’t be completed. I asked Apple about this once and they said that the behavior for AC is different than if an MDM does the actions. THey said it should be able to connect to wifi (this coming directly from an engineer) but this runs counter to the behavior we actually witnessed. It’ll be interesting to see what they say to you
*Thread Reply:* I always believed that key material stored in the keychain is not accessible until the user enters the password following a reboot. At least that is my experience and always thought this caused the wifi not to connect. So my experience is indeed also opposite of what the Apple engineer said.
*Thread Reply:* Actually, it is even described by Apple in the ios security guide: https://www.google.com/url?sa=t&source=web&rct=j&url=https://www.apple.com/business/docs/site/iOS_Security_Guide.pdf&ved=2ahUKEwi6ho7VkvTlAhVLa1AKHVNOAl8QFjAAegQIBhAB&usg=AOvVaw3Ujo8tzl-eehO9Buh7Q4iQ
Page 21.
An wifi password is only accessible after first unlock. Certificates are always accessible though. So i guess it depends on the Wifi network configured.
*Thread Reply:* Which tracks with it not working on captive networks - but if I use my mobile hotspot with a passcode on it, the action will work.
*Thread Reply:* I’ve opened a case to get a definitive answer on this and won’t let up until I have all I need. Let me know if there any questions you’d like answered around this topic ;)
*Thread Reply:* the only thing we observed since ios 13 is, that devices are sometimes slow when you try to enter your passcode. And if you enter the digits to fast, not all entries are taken, which results in errors
*Thread Reply:* Definitely noticed that! Also this here: https://www.theverge.com/2019/10/31/20942043/apple-ios-13-iphone-11-pro-ram-memory-management-app-background-refresh
*Thread Reply:* Does the VIP have this issue with an iPhone or iPad? We recently had a issue where the iPad Pro with an Apple keyboard was defaulting to caps lock which is why the passcode wasn’t being taken. Again not sure if they have a numeric pin or complex but figured it was worth sharing
*Thread Reply:* Removing the pin from the SIM of my phone and putting it in the affected device allowed the clear passcode push to hit the device and thus resolved the issue...yes it really was that simple...who would have thought but for some reason my head was stuck in carrier mode and not disabling the goddamn pin from within the iOS setting...! Just awaiting log analysis from support!
*Thread Reply:* Did you ensure that the OG that you are enrolling into has User enrollment enabled : https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/1910/iOS_Platform/GUID-9759D1D5-D76C-4139-BF7A-8965F50E353F.html as well as require MDM agent for iOS is not enabled?
*Thread Reply:* „Your account could not be registered. Please talk to your system admin.“
*Thread Reply:* If you turn off user enrollment at that OG, does it work?
*Thread Reply:* Looks like you shouldn’t even get to the portion where it asks for a password when user enrollment is enabled at the OG.
*Thread Reply:* I dont believe that "User Enrolment" and the Azure AD // ABM connection are interlinked.
They are separate subjects not reliant on each other.
The Azure connection is just to that users can use their corporate credentials as their apple ID, and user enrolment is just a form of iOS "Work Profile" enrolment, which is not reliant on any specific corporate apple id.
**Turns out I'm wrong... :)
*Thread Reply:* @DirkC “User credentials are invalid”, is what I get then.
*Thread Reply:* Sounds like something is wrong with your user.
*Thread Reply:* @Simon Hardy-Bistagne Ah okay, thanks for claryfication. Still I’ll have to dig deeper in order to find out, how to make this scenario work for me.
*Thread Reply:* @Simon Hardy-Bistagne @Julio User enrollment requires a Managed Apple ID to function (MAID). You can either create the IDs manually, or federate to Azure AD.
*Thread Reply:* Workspace ONE UEM has the user install a special management profile that will have the user input their managed Apple ID email address an password within a special GUI. Sounds like Julio may be running into an issue with the user.
*Thread Reply:* Are you able to ensure that the enrollment organization group of the user is set to the OG where user enrollment is enabled and that a duplicate user account with the same email address doesn’t exist?
*Thread Reply:* The instrunctions on how to make it work without Azure AD in Workspace ONE are already a hot mess. Tried it yesterday and didn’t get it to work.
*Thread Reply:* works fine here in regards of the WS1 guide
*Thread Reply:* What if the email is already registered as a private Apple ID? Is there a solution for that? I mean the solution of course could be to use the recommended subdomain as an managed apple id.. like user@managed.company.com. I know there is no possibility to convert existing private apple ids into managed apple id (except having the user change the domain of the private apple id so the original email domain frees up)
*Thread Reply:* Learned yesterday, if it is a company domain that is assigned in ABM it can be claimed by the company. User gets informed and has 60 days to remove his personal data from it. After those sixty days it becomes a Managed Apple ID.
*Thread Reply:* Really? And this is triggered when creating that particular managed Apple ID?
*Thread Reply:* As far as I was told, yes. But would have to try it to confirm it. Got that info from a certified Apple trainer in an iOS 13 training yesterday.
*Thread Reply:* Very cool information, thank you. Will also try this.. On that same note: Do you know if there is a way to do a bulk creation or only one by one possible?
*Thread Reply:* Raised that same question yesterday. He said using CSVs that you can upload to ABM would give you that possibility. It would have to follow a specific template, that I haven‘t seen yet, but it should be possible.
*Thread Reply:* Federation is the best approach as local Apple ID creation, even in bulk may have unintended consequences when attempting to manage the services and access those ids have. For instance, I have heard anecdotally that local, managed Apple IDs have issues with User-based Enrollment. The success of enrollment is not consistent when using them. Whereas, federated identities tied to managed Apple IDs work consistently.
*Thread Reply:* Does it matter which IdP is in place? Like PingFederate, ADFS, etc? Is this just for Azure AD?
*Thread Reply:* @Julio after the 60 days the personal appleid gets assigned a random username , so that the company email can be used as a managed appleid. The personal doesnt auto transfer to managed
*Thread Reply:* But as far as I was told this feature works only for the federated authentication, not when adding managed apple ids manually or via CSv
*Thread Reply:* Indeed only for federated accounts
*Thread Reply:* Since you mentioned SSO.. at one point the user has to provide the password, right? Or can this be done seamless?
*Thread Reply:* Federated means that your users will use the existing password for the identity that is federated to ABM. For example, I have an ID called me@me.com. This identity is what I would use to authenticate and thus I would use the password associated with that identity service. Behind the scenes, Apple creates an managed Apple ID that is obfuscated from the user, but assigned based off of your ABM settings.
It seems that apps are allowed more time in the background since iOS 13.2.3 as reported here where they were being killed more often: https://www.theverge.com/platform/amp/2019/10/31/20942043/apple-ios-13-iphone-11-pro-ram-memory-management-app-background-refresh
:no_upscale()/cdn.vox-cdn.com/uploads/chorus_image/image/65595737/akrales_190918_3645_0166.0.jpg)
Not to Chrome...
}
*Thread Reply:* Thanks Peter that's what I figured I hadn't found a way to do so but figured I would ask in case someone had some black magic up their sleeve :D
*Thread Reply:* Don’t know why they support App Config on Android but not on iOS
*Thread Reply:* Nothing new in here, if you’ve been following the iOS 13 updates, as far as I can tell. But some documentation is more clearly written.
*Thread Reply:* yes I've been having issues as well. I will sometimes have to force close the mail app to have it reload. Manual refresh will not work
*Thread Reply:* Up until 13.2.3 there where many issues with mail notifications. These are known issues with Apple and I believe most of it is solved now with 13.3
*Thread Reply:* Each release of 13 has address some sort of email issue hopefully 13.3 finally fixes the last of them but only time will tell.
*Thread Reply:* https://support.apple.com/en-us/HT210393
· Fixes issues in Mail that may prevent downloading new messages · Addresses an issue that prevented deleting messages in Gmail accounts · Resolves issues that could cause incorrect characters to display in messages and duplication of sent messages in Exchange accounts
*Thread Reply:* Few of my users have been facing issue deleting emails from their Apple native mail app. Deleted mails appear again in the inbox. They are all on iOS 13.2.
*Thread Reply:* Hi @Jeoffrey Burri! They shouldn’t update automatically. Rather, they will prompt the user to update to 13.0. The user can decline.
*Thread Reply:* This example in particular: > For example, you have an iPhone fleet running the latest version of iOS 12 and you have applied a deferred software update payload of 90 days to all of them. As the table above illustrates, iPhone users begin to have iOS 13.0 offered to them on December 18, 2019, as 90 days have passed since the launch of iOS 13.0.
*Thread Reply:* You may consider removing the deferral restriction, so users are prompted for 13.3 instead.
*Thread Reply:* Thanks @aaron! My users are not allowed to decline any update I generously decided to offer them 🙂. I'll remove the deferral altogether since many bugs got fixed in the mean time.
*Thread Reply:* BTW. dont try combining deferal with allowing a specific version to update to. It simply doesnt work properly
*Thread Reply:* SimpleMDM allowed me to generate my own screen ... it’s there since 13.0
*Thread Reply:* Realize that, just looking for some demonstration videos etc
*Thread Reply:* @Sharkey Is that a config that is pushed post DEP wizard?
*Thread Reply:* Yeah. Part of the managed settings I believe.
*Thread Reply:* K. Trying to find it in MI Core. Don’t know if they included it in the UI
*Thread Reply:* It’s not a profile for sure. At least in WS1.
*Thread Reply:* I wonder if we can set a device name prefix and have it generate based on that…
*Thread Reply:* Possible in WS1. Not sure if it sticks in settings. Might have to set a restriction profile to grey it out.
*Thread Reply:* Where is it located in WS1? I’ve checked most areas in MI Core but perhaps I’m overlooking it
*Thread Reply:* Also have to either allow name changes (not applying the block profile) or be iOS 13+
*Thread Reply:* In MI Core as of 10.5 you can create a Change Device Name policy for supervised devices.
*Thread Reply:* Nice! I’ll get our DEV up to 10.5. Thanks @Almar Diehl and @Stephen
*Thread Reply:* We got the word that they should be able to be used everywhere, a couple of months ago there were some exceptions but not anymore
*Thread Reply:* I don't think so, but you know people will figure that out in 2 minutes right? There's always a smartass in every office that will tell everyone the key and within a week every unauthorised device will be on it 🤣 (I know because I used to be one of those smartasses before I was in IT)
*Thread Reply:* I view QR more as a convenience feature rather than to hide the PSK
*Thread Reply:* @Woody why not create a temp wifi just for the enrollment with simple password?
*Thread Reply:* At one organization, I created a dedicated SSID named "Provisioning" open network, no PSK. It was throttled to 1mbps, and was filtered to only allow access to Apple, Google and the MDM. The WAP was tuned to low power that only spanned a radius of the provisioning rooms within the building.
*Thread Reply:* @Nick That’s actually more the direction we’re going. A Provisioning network with limilted access/bandwidth.. to be used strictly to ramp-up into EMM.
Nettes Seminar (Deutsch) : https://www.comconsult-akademie.de/ios-im-unternehmen/
*Thread Reply:* Their is not a contacts app from Google you have to use the iOS native one
*Thread Reply:* @Stephen yeah, we were discussing that using CardDAV. My thinking is that the two aren’t going to integrate well
*Thread Reply:* Google's own advice is to use the native contacts and google account profile I am not sure how you would integrate CardDAV and would only do so with a really really good reason, once you have contacts you get mail and calendar so you might as well use them native plus all apps with a send email button go to native
*Thread Reply:* Right @Stephen? That’s my thought as well. Don’t mix/match
*Thread Reply:* Mac address is not a field that ABM gives out
*Thread Reply:* Is there a reason you're using a MAC filter? Spoofing a MAC address is pretty easy. Might work better to do something like certificate based auth, and have WS1 deploy the certificates and wifi config on enrollment.
*Thread Reply:* @Andrew Olpin Yeah that's exactly what we do. It offers great security.
But I suppose @Damian is looking to do this to facilitate the enrolment itself. This is actually a tough point for us too. If a device has no 4G (like most iPads we have) it's really annoying to get them onboarded because our guest network times out too quickly.
*Thread Reply:* Definitely, I would go with RADIUS auth using certs
*Thread Reply:* for enrolment i would suggest a dedicated enrolment SSID with minimal restrictions and then deploy the corporate SSID via MDM
*Thread Reply:* @Tycho Create a hidden "Apple Store" network without password. oops did i say that out loud? 🤔
*Thread Reply:* Should have explained a bit better! Our corp Wi-Fi is actually outsourced so it’s public in a sense that requires registration via SMS and only lasts 24h. We need to register all corporate iOS devices’ MAC address before enrollment begins. Might just have to poll our carrier’s database or export of some kind.
*Thread Reply:* roundabout option but if you had a simple secondary wi-fi box you could attach them all to then you could export the MAC addresses from there maybe
*Thread Reply:* My understanding is that the ABM API is only available to MDM partners and is not published due to them not being customer-facing.
*Thread Reply:* Other partners have some documentation as well but @DirkC is correct - you have to be a partner of Apple to have access to that.
*Thread Reply:* Maybe one day Apple will expose a REST API endpoint for public consumption.
*Thread Reply:* Actually it is documented here: https://developer.apple.com/documentation/devicemanagement/device_assignment?changes=latest_minor
*Thread Reply:* Or is that the legacy DEP Portal documentation?
Just started a thread on the workspace one forum if anyone wants to contribute? Thanks https://mobilxperts.slack.com/archives/C1V75UE76/p1580748855065200
*Thread Reply:* I believe the only way is to contact Apple Support
*Thread Reply:* @iMZ Out of curiosity ... why are you wanting to completely remove ABM from your company?
*Thread Reply:* Legal? The OS itself is free. I use Mac VMs all the time for DEP deployment engineering.
*Thread Reply:* Thanks, was just checking if there was anything in the T&C's regarding VMs
*Thread Reply:* Haven’t read anything specific from Apple. Sure they would discourage it. If worried by yourself an old, cheap Mac mini. It will do the job.
*Thread Reply:* Can I ask what VM environment you are running? Wondering if we can store the VM on a network server and have USB passthrough to connect devices to the local machine
*Thread Reply:* I’m just running them in a Mac using parallels. Nothing fancy.
*Thread Reply:* I seem to remember that you are only allowed to run macOS on Apple hardware. You can use Parallels/Fusion/etc on your MacBook/MacMini but are not allowed to run the same VM in VMware Workstation on Windows....
*Thread Reply:* Thanks, that's the impression I'm getting too, plus the fact I think the Mac VM only runs on Mac hardware
*Thread Reply:* Ahh. You can actually get the Mac to run in a VM on Windows - so I've heard :)
*Thread Reply:* Yes you can do it with donk's unlocker on Windows, not legally of course.
Cool thing is on ESXi if you install it on a Mac it will automatically enable macOS guests.
*Thread Reply:* Yes as stated above its only “legal” to run OSX VM’s on Mac hardware and normally apple only allow host + 2 OSX VM’s under the EULA
*Thread Reply:* native mail: great integration with your on-device services Gmail (or Outlook or other 3rd party): less integration with on-device services (maps etc) but perhaps better integration with backend services
*Thread Reply:* @Peter Mohr Oh, and… Google has GMail AND Google Calendar. Those will sync contacts to our user’s device for phone calls, right?
*Thread Reply:* @Woody maybe, but my point is integration. If you want your users to be able to use their contacts for Siri, for Maps, for other 3rd party apps etc then you might need to go Native. It also depends on your level of GDPR compliance 🙂 As an example, if you use MS Outlook and want to have contacts and callerId, then you need to enable iCloud sync for your contacts. This puts corporate contacts in a person iCloud <> GDPR compliant... Then you need to limit contacts to stay inside Outlook and then you have lost your users... Perhaps GMail is different, I don't know...
*Thread Reply:* @Peter Mohr Totally know where you’re coming from. My statement above was received from my counterparts who maintain our GSuite service
*Thread Reply:* @Woody 🙂 I figured. just trying to put in arguments to help you...
*Thread Reply:* but basically you need to choose between on-device integration and back-end integration
*Thread Reply:* I choose on-device integration whenever I can !!
*Thread Reply:* Great way to look at it though! The back-end integration in this case is less than existent. On-device is certainly preferred.
*Thread Reply:* Does GMail has CallKit integrated to identify the caller ID without syncing contacts to native contacts app?
*Thread Reply:* @Nico Hermeling even if it has CallKit I'd also like to be able use my contacts from Waze, Paypal, Messages, Maps etc... CallKit doesn't help there.
*Thread Reply:* It was a general question, not in regards of your point of view.
*Thread Reply:* I know 🙂 my point was that callKit is not super important (but relevant for sure)
*Thread Reply:* Google Hangouts support callkit, but GMail doesn't as far as I can tell. Google Contacts is synced using the "accounts and passwords" in native settings UI
*Thread Reply:* @Woody last point: GMail can't be configured using MDM on iOS (again, to my knowledge) and thus Native is better 🙂
We don't want/need users to do anything to get rolling. We'll set everything up for them
Not iOS specific they are general ones https://arstechnica.com/information-technology/2019/06/microsoft-says-mandatory-password-changing-is-ancient-and-obsolete/ and they are not the only ones
*Thread Reply:* NIST recommended this in 2017, majority of companies are struggling to accept this new recommendation.
*Thread Reply:* check the NCSC guidelines on this. good reference https://www.ncsc.gov.uk/collection/passwords/updating-your-approach
*Thread Reply:* also Cyber essentials have good guidance https://www.cyberessentials.ncsc.gov.uk/requirements-for-it-infrastructure
*Thread Reply:* relevant section of Cyber Essentials guidance Password-based authentication The Applicant must make good use of the technical controls available to it on password-protected systems. As much as is reasonably practicable, technical controls and policies must shift the burden away from individual users and reduce reliance on them knowing and using good practices. Users are still expected to pick sensible passwords. For password-based authentication in Internet-facing services the Applicant must: • protect against brute-force password guessing, by using at least one of the following methods: • lock accounts after no more than 10 unsuccessful attempts • limit the number of guesses allowed in a specified time period to no more than 10 guesses within 5 minutes • set a minimum password length of at least 8 characters • not set a maximum password length • change passwords promptly when the Applicant knows or suspects they have been compromised • have a password policy that tells users: • how to avoid choosing obvious passwords (such as those based on easily-discoverable information like the name of a favourite pet) • not to choose common passwords — this could be implemented by technical means, using a password blacklist • not to use the same password anywhere else, at work or at home • where and how they may record passwords to store and retrieve them securely — for example, in a sealed envelope in a secure cupboard • if they may use password management software — if so, which software and how • which passwords they really must memorise and not record anywhere The Applicant is not required to: • enforce regular password expiry for any account (we actually advise against this — for more information see The problems with forcing regular password expiry) • enforce password complexity requirements
*Thread Reply:* As far as I know, shared mailboxes are not supported for ActiveSync. Outlook Mobile uses Exchange Web Services, which support it.
*Thread Reply:* Outlook app on O365 will do it
*Thread Reply:* Outlook > Settings > Add Mail Account (under Mail Accounts) > Add Shared Mailbox
*Thread Reply:* Should be, https://support.apple.com/guide/mdm/cellular-mdma34b7357/1/web/1
*Thread Reply:* Policies & Config / Configurations / Add New / Apple / iOS / tvOS / APN ?
*Thread Reply:* This APN config was deprecated a long time ago and only configures the APN, not the personal hotspot
*Thread Reply:* @Thomas B. Thanks, but it says nothing about the personal hotspot, only the main APN
*Thread Reply:* I wonder how long until the big MDM's will support this new feature
*Thread Reply:* Shouldn't be too long as far as I've heard.... It's very much like EDU Shared ipads. Just minor changes in the admin part
*Thread Reply:* Business doesn't get the 200gb icloud chunk per user correct?
*Thread Reply:* will have to do some testing, we disable a lot of the cloud features via our MDM for data sovereignty concerns.
*Thread Reply:* Also included temporary sessions, like a guest account for iPad
*Thread Reply:* here is WS1 info on the subject: https://techzone.vmware.com/blog/what-are-shared-ipads-business
*Thread Reply:* By blacklisting I am guessing you mean you hid the messages app?
*Thread Reply:* Yes, I have it in the Backlist in Jamf Pro
*Thread Reply:* And DLP settings can't stop this? Allow open documents from managed sources in unmanged destinations set to false? I would think this would stop your issue
*Thread Reply:* Changing those settings doesn't seem to make any difference it the behavior.😢
*Thread Reply:* Notes won’t be flagged as managed, as it is a system app. I guess the only way would be to promote a thrid party note taking app, and deploy it via MDM to flag it as managed, then the open-in restriction should apply.
*Thread Reply:* But Mail, Calendar, Contacts and Safari do support manage/unmanaged settings even if they are system apps so perhaps a managed account in Notes will do the same (haven't tested Notes though) - But just because they are system apps doesn't mean that they can't handle managed open-in 🙂
*Thread Reply:* You are right, but they use either managed account or managed domains respectively, so that is why you can apply open-in restrictions to it. No such things in Notes though…
*Thread Reply:* Thanks for all the help on this
*Thread Reply:* Are you pushing PDFs to iBooks? If so you can convert to ePub before pushing then use “itms-books://“ to open up that ePub possibly.
*Thread Reply:* Currently yes we are publishing PDFs. If we use “itms-books://“ what would the url of the ePub after be? The file name?
*Thread Reply:* iBooks:// also launches the books app but just want to show users the PDFs or ePubs we push down
*Thread Reply:* Does SAML/Modern Auth need to be enabled for your MDM appliance as a whole, which is then extended to the Apple DEP facet for enrollment?
*Thread Reply:* Does not yet appear to be an option inside MI Core 10.6
*Thread Reply:* OR if you have ABM/ASM but no Azure. Just upload a CSV file into the AxM environment and all the accounts gets created.
*Thread Reply:* Sounds great, but I can’t see where to upload. I’m probably missing something obvious. @Peter Mohr or @Jason can you post more details?
*Thread Reply:* https://support.apple.com/en-us/HT207029
*Thread Reply:* Does Apple Business Manager have the same feature?
*Thread Reply:* Ahh. I might have overlooked that SFTP is not supported by ABM. It only works in ASM 😞 dammit
*Thread Reply:* Mind you, I would also argue that AAD integration would probably be the default method for most organisations, so this upload wouldn’t be necessary?
*Thread Reply:* @Jason this would only be the case if you are using AAD as your primary iDP and of course your users havent set up Apple ID's with their email address previously.
*Thread Reply:* @danlux says he doesn’t have Azure AD. For shits and giggles, I just tried federating groundctl.com to our (mostly unused) AAD test environment, and Apple says there are 45 Apple ID conflicts. Curious, since we had at most 18 employees…
*Thread Reply:* @Ajay Patel @aaron I was talking about the more general case, sorry for any misunderstanding. I recognise that this won’t always apply, but it probably would be the default approach for most organisations looking at doing this afresh.
*Thread Reply:* Yes, especially considering the lack of any alternative.
*Thread Reply:* AAD being the only IdP integration is short sighted. Use standards based integrations rather than product specific integrations when it comes to identity (SAML, OAuth, OpenID, etc) would be much more viable for most enterprise customers.
*Thread Reply:* im not an MS License expert but O365 E1 should do the trick for teams since the app doesnt need to get licensed with ms (other than office). Just buy it in ABM for free. BUT you will need EMS/Intune licenses for security
*Thread Reply:* The apps themselves are free and will work in a read-only mode. When the user signs into the application, it will allow the user access to the application depending on the SKU you assigned to the AAD user.
*Thread Reply:* Might be different for macOS though. Application might refuse to function unless it is licensed.
*Thread Reply:* Thank you @DirkC, that makes sense. However we are currently using ABM with Workspace One.
Yes! We now have an SSO extension from Microsoft 🙂 https://docs.microsoft.com/en-us/azure/active-directory/develop/apple-sso-plugin
*Thread Reply:* this is huge - do you know if there's a plst on what the config to the device needs to look like in case we aren't using intune
*Thread Reply:* For share device or for the SSO extension?
*Thread Reply:* ?? The config options are listed at the top. In the section "Enable the SSO extension with mobile device management (MDM)" https://docs.microsoft.com/en-us/azure/active-directory/develop/apple-sso-plugin#enable-the-sso-extension-with-mobile-device-management-mdm
This is standard iOS 13 SSO Extension config parameters. No plist/app config required
*Thread Reply:* I don’t recall it being mandatory - just that if you want access to corporate style restrictions, the only way will be if the device is supervised, hence ABM/DEP enrolment.
*Thread Reply:* Apple is revoking the restrictions/controls over BYOD to protect user’s privacy
*Thread Reply:* As for Managed AppleIDs, I have not seen any mention of these being mandatory for anyone?
*Thread Reply:* The WWDC video you’ll be looking for is session 303: https://developer.apple.com/videos/play/wwdc2019/303/
*Thread Reply:* That too.... You have to resolve all the conflicts when you sign up. Great, when you have 160.000 users and there's no API to automate it 😛
*Thread Reply:* yikes, you've got 10x the users, I can't even...
The new iMazing Profile Editor includes these options: https://imazing.com/profile-editor
*Thread Reply:* Yep, iPad OS identifies as MacOS in Safari. Started right away when iPad OS was introduced.
*Thread Reply:* Yeah! I do wish they would allow to disable that setting for selective sites, instead of across the board. I’d rather keep it identifying as desktop.. but only stick with “mobile” for WebEx
*Thread Reply:* This actually causes more issues. For example registering the device on MobileIron Cloud. When Safari is set to Desktop, the device will be seen by MI Cloud as a macOS devices rather than an iPadOS device. So be carefull with that desktop mode in Safari
*Thread Reply:* Yeah / I noticed that while I was enrolling to test Core + Access SaaS last week @Mark Vonk. I wonder if its possible to disable as a Supervised control?
*Thread Reply:* Same with Box (dropbox alternative). It prompts to install the compliance validation tool for Mac...
*Thread Reply:* Though I have to say, if programs are using the User-Agent header they are doing it wrong... It's nothing but a kludge.
*Thread Reply:* At least the browser makers are understanding that now too.. https://www.zdnet.com/article/google-to-phase-out-user-agent-strings-in-chrome/
*Thread Reply:* Most vendors fixed this before iOS 13 went GA. Can’t believe Webex hasn’t yet
*Thread Reply:* Def a huge mess with user agent strings and will be interesting to see how Google’s move shifts things
*Thread Reply:* @Kiran Patel curious what vendors that addressed it used to identify the device as still being an iPad. Or if they went with the Client Hints framework?
*Thread Reply:* Have an issue with full screen webclips in 13.4. It takes 10 to 15 seconds to open the webpage. Disabling the full screen option 'solves' the issue.
*Thread Reply:* I have an issue with the AirPods for outgoing phone calls
*Thread Reply:* We’ve seen that if Safari is set to private mode that our webclips for our enterprise App Store that uses CBA doesn’t work with no real error that helps an end user
*Thread Reply:* Read the section about HTTP Proxy at the bottom of this URL https://support.apple.com/en-gb/HT210060 i assume this is what you refer to?
*Thread Reply:* Have you checked the test plan for Proxy PAC APNS on AppleSeed for It?
*Thread Reply:* enrolled in my corporate workspace one tenancy, we don't do a wifi profile
*Thread Reply:* networks insists they see it authenticating successfully.
*Thread Reply:* Maybe this: https://support.apple.com/en-us/HT210176
*Thread Reply:* The only thing for MDM to support is to disable the guest login. Do you mean that?
*Thread Reply:* Ok, but why didn’t i see the shared user option on my iPad (supervised, DEP, 13.4) ?
*Thread Reply:* Ah, you threw me off with the question about temporary… The shared features are a DIFFERENT supervision option.
*Thread Reply:* And that option is visible only if you enable EDUCATION features. (This is AirWatch-specific, not sure about other MDMs.
*Thread Reply:* Ok, hmm , i enrolled my iPad with DEP via Apple Configurator :(
*Thread Reply:* Airwatch has not added support for Business use for shared iPads yet, they say it is coming in a new console coming in a few weeks https://blogs.vmware.com/euc/2020/03/what-are-shared-ipads-for-business.html
*Thread Reply:* MobileIron will add it in near future too
*Thread Reply:* Hi. You should be able to add a webclip with a <tel://|tel://> link.
*Thread Reply:* Tried this out, seems like Safari blocks this out after I cancel the call three times. Then I have to accept thrice to allow it. Not a very reliable idea I guess. Now just looking for a way to permanently disable this block. 🙂
I'm sure you've seen this security issue in the iOS mail app that was published yesterday: https://blog.zecops.com/vulnerabilities/unassisted-ios-attacks-via-mobilemail-maild-in-the-wild/ Is anyone taking action based on this?
*Thread Reply:* Yes, this looks pretty bad, but since there is no patch available its a big decision for organisations. Most likely Apple will release a patch for this within few days, then it doesn’t seem reasonable to start migrating users from Native app to Outlook/Gmail.
Options from Exchange ActiveSync:
- Block all iOS versions under 13.4.5
- Disable EAS until there is a patch
- Disable and Wipe Data I am currently not aware if there are any proactive blocking or detection capabilities within Exchange or typical IPS software.
There is speculation about iVerify app being potentially able to detect this attack.
*Thread Reply:* Mitigation actions that I am aware of are: • Update to latest beta 13.4.5 using Apple Beta Software Program • Disable auto sync- Go to Settings > Password & Accounts. Set Fetch New Data to “Manual” and disable “Push”. • Use Safari or dedicated E-Mail clients such as GMail and Outlook
*Thread Reply:* Agree with you @Alo Press, no point in rushing to migrate people to a brand new app as they’ll address and patch in a very short window
*Thread Reply:* Also curious to know if any of the email content that can trigger the vulnerability made it past SPAM/Junk filters of any of the major Email players.
*Thread Reply:* Question is given the severity of the apparent severity of the vulnerability, will Apple release patches for iOS10/11/12 or are all iPhones prior to the 6S now a huge liability?
*Thread Reply:* I’d guess they would touch them all, but to be safe I’m forcing out devices that don’t support 11, 12 or 13
*Thread Reply:* @Alo Press great input 👍 Switching to manual sync and disable push - that would only avoid automated actions but if the user will use the mail client we are back to square one, right? I am not sure what actions we should really take - like you guys mentioned migration to another app is a pain - specially for us. We us KCD with MobileIron so Outlook is out of the game. Email+ and Notifications is a pain if no VIP notifications are configured.
*Thread Reply:* Thanks for the great input. Given the (hopefully) near release of 13.4.5, our main action right now is to prepare end-user communication to get the devices updated as soon as possible
*Thread Reply:* We just had an internal huddle on this as well. Wanting to refrain from a knee-jerk reaction, especially with so many of our workforce being remote during this time, Would rather continue as-is and use Supervision to push the patch, knowing Apple has a fix in the pipeline.
*Thread Reply:* Fun part is that I’m dealing with “Google Nation” over in our shop, so they take shots at iOS every chance they get
*Thread Reply:* Maybe I'm reading this wrong but based on Apples response to me it sounds like it's coming as a patch to iOS 13 rather than an Apple Mail app patch. So if I'm understanding that correctly the only way to be secure will be to go to that latest OS release or use a third party mail client. https://www.theverge.com/2020/4/24/21234163/apple-ios-ipados-mail-app-security-flaw-statement-no-evidence-exploit
*Thread Reply:* iOS Mail app only ever gets updates in an OS update that I have sern
*Thread Reply:* Was anyone able to find evidence of this in the iOS/iPadOS 13.5 release notes yesterday?
*Thread Reply:* Hey @Woody did you ever come across anything saying it was actually patched. I see 13.5.1 is out but I still haven't been able to find anything confirming its fixed
*Thread Reply:* https://support.apple.com/de-de/HT211168
*Thread Reply:* You could secure Safari :-) or you can Use:
microsoftedgehttp:// or microsoft-edge-https:// in your web clip
*Thread Reply:* Thanks! Could you expand on “secure” ? 😊
*Thread Reply:* Sure. You can limit what Safari can be used for with a few different tools:
- Deploy “Safari Domains” - this tells Safari where corporate data is found and where personal data is found. For each site/tab it will then be treated as corp or personal data
- Deploy DLP restrictions to your device. You can limit how data flows in/out of the two containers/areas or your iOS devices. You can block CORP->Private but allow Private->CORP or vice versa og both or… You get the picture.
- To take this even further you can impose a white- or black-liost of URLs in Safari. Then Safari itself will stop users from accessing blocked sites. You can also enable Apples “auto-block” functionality and let Apple decide what is good and bad for your users.
- Finally you can also deploy some sort of MTD (Cisco Security Connector, Carbon Black - now from VMware, zimperium - integrated with MobileIron or even Microsoft ATP - in preview) to get on-device protection from outside threats.
*Thread Reply:* 1-3 is build into iOS.. 4 is an additional agent of some sort
*Thread Reply:* Yeah we studied Safari domains at the beginning of our project and there were some issues there. Can’t remember off the top of my head but we do currently use it for internal sites just not for O365. We also have DLP deployed but in testing this didnt apply to Safari and we for example we’re still able to download attachments from login.microsoftonline.com not sure if there are certain restrictions we missed there but it was all tested in conjunction with VMWare professional services.
*Thread Reply:* Regarding the edge scheme that didn’t work - it just opens in Safari with this part even though I added the url after it: Microsoft-edge-https and nothing else. Can you add an example of this with the full url in case I’ve missed something ?
*Thread Reply:* yeah, you can’t block download of attachments in Safari per domain, that must be done server side, BUT with Safari and DLP you can control WHERE those attachments end 🙂
*Thread Reply:* Use this: Microsoft-edge-https://my.fqdn.com/vdir/
*Thread Reply:* you must remove the normal http:// and https://
*Thread Reply:* I did, will have a look after my lunch 😊
*Thread Reply:* ok. I just tested again. works for me 🙂
*Thread Reply:* Probably white space 😉 I’ll check in a bit
*Thread Reply:* Just need to work out how to leverage Edge on Android for the same need
*Thread Reply:* Created a web app for AFE but wondering how to force it to open Edge
*Thread Reply:* @Peter Mohr any idea how to force it to use Edge on AFE - tried both microsoft-edge- and another variation microsoft-edge:
*Thread Reply:* @Damian should be something links this:
microsoft_edge:<https://www.google.com>
but haven't tested this just now.....
*Thread Reply:* Tried that variation and get “Enter a valid URL”
*Thread Reply:* I’ll keep looking, in the meantime adding the guru here @Jason Bayton
*Thread Reply:* Yep, not the same as Android though lol
*Thread Reply:* These guys have gotten it to work too: https://stackoverflow.com/questions/31909274/launching-microsoft-edge-with-url-from-code and https://stackoverflow.com/questions/59846066/url-scheme-to-call-the-microsoft-edge-app
how are you building your links on your device. Using mail or text or MDM or ?
*Thread Reply:* I tried from Chrome within “Work” and it doesn’t work
*Thread Reply:* Tricky. Webview is based on Chrome and that's how these apps launch, I'm not sure it's possible to swap out the underlying engine like this.
*Thread Reply:* However...when I opened Edge in work for the first time I get this which allows me to choose Edge as the default browser. I wonder if it’s opening Edge or Chrome inside the web app. I’m going to block Chrome from the O365 url and see what happens
*Thread Reply:* It's a webview application, the chrome webview engine superceded Android's AOSP webview for GMS devices some years back so even if another browser is default, this still opens in Chrome webview and requires Chrome is on the device.
*Thread Reply:* @Jason Bayton any concerns using Chrome “Work” for access to a single O365 url - our restrictions are pretty tight.
*Thread Reply:* No, managed config for Chrome will allow you to blacklist everything and whitelist only your chosen domain. The webapp will respect that also
*Thread Reply:* Domain/URL/wildcard that is. Not just domain
*Thread Reply:* Yep we control that already with our device traffic rules. On another note, blocking chrome on that url also renders the web app blocked and so is logical as per your previous comment. Thanks for taking the time to respond - appreciate the insight and have learned something today. Thanks to @Peter Mohr for his efforts 😉
*Thread Reply:* Following. AFAIK, there is no capability to do this in iOS.
Has anyone payed attention to this vulnerability on iOS devices and what can we do with MI Core?
https://world-today-news.com/another-zero-day-vulnerability-in-ios-apps-can-break-out-of-sandbox/
*Thread Reply:* This is due to be addressed in 13.5 (which is in Beta 4). I’d guess they’ll have it releasing as quickly as possible.
*Thread Reply:* Agree.. let’s see if they will release it mid may. Not sure if there is anything you can do right now anyway!
*Thread Reply:* really interesting exploit. link is in article @Mikey2000 posted but just in case here is the detail https://siguza.github.io/psychicpaper/
*Thread Reply:* no evidence apps would get past App Store checks though so risk is probably low for managed corporate devices
*Thread Reply:* @Mikey2000 MTD would detect this anyway with Elevation of Priviledges threat
*Thread Reply:* Was anyone able to find evidence of this being addressed in the 13.5 release notes yesterday?
*Thread Reply:* ZeCops confirmed 12.4.7 & 13.5 fixed
*Thread Reply:* https://twitter.com/zecops/status/1263516074634440706?s=21
}
Twitter
Twitter
*Thread Reply:* Haha / I bet ZecOps was waiting patiently for that proof
*Thread Reply:* https://blog.zecops.com/vulnerabilities/hidden-demons-maildemon-patch-analysis-ios-13-4-5-beta-vs-ios-13-5/
*Thread Reply:* Since the updates are out now, how do you block versions which are lower than 13.5 and 12.4.7 with one security policy - I guess thats not possible since there is only one dropdown field. Suggestions for MobileIron Core?
-Use two security policies and use filter labels which target the specific versions - if this is possible
-Use the version check in a compliance policy instead the security policy
*Thread Reply:* I’d create 2 labels using Model and OS as conditions, and apply 2 different security policies, one to each label
Has anyone played around with this new DLP feature from Google? https://gsuiteupdates.googleblog.com/2020/04/ios-dxp-data-exfiltration-protection.html
*Thread Reply:* Curious what tech it uses to compliment an existing MDM scenario
*Thread Reply:* looks very similar to Intune app protection (MAM) controls
*Thread Reply:* It's all within the Google apps so prob not using any native capability
*Thread Reply:* Agree @Paul Conaty. Probably messy to administer alongside iOS native
*Thread Reply:* depending on the URL it will open one or other browser
*Thread Reply:* http;// and https:// always opens Safari
*Thread Reply:* Great input - thank you 👍✌️
*Thread Reply:* Can I run a webclip in Single App Mode?
*Thread Reply:* If you are on Mobileriron, you can use their Web@Work browser. That one does allow for bookmarks configured from Core
*Thread Reply:* Right Mark, thanks. Sorry I forgot to mention I am looking for a browser which I can run in single app mode (one website) and maybe SSO - and W@W is not supported in Single App Mode (at least that is what the MI support told us)..
*Thread Reply:* Activation lock requires the prior user’s Apple ID name and password when a device is set up. It locks that device to the user. But every DEP device is owned by a company, not an individual user. Why give users power over the company like that?
I agree. Turn it off always.
*Thread Reply:* @aaron agreed, yet i still see SOO many customers with this option enabled and i couldnt think of any genuine reason as to why
*Thread Reply:* Bad feature design compounded by poor UX? Call it “Apple ID password lock-out” and nobody will enable it. Even better, never show this in any MDM. Supervision already disables activation lock — this feature defeats supervision and forces activation lock on.
*Thread Reply:* I’m in agreement. I’ve racked my brain for use cases for this and can’t seem to come up with any viable reasons 🤷♂️
*Thread Reply:* We have a use case where people trade in their DEP device at an Apple Store to get $ for a personal device. Apple will accept the trade in unless AL is enabled. MDMs can enable AL but our MDM (WS1) doesnt support this yet. I realize this may not be super prevalent but it has happened multiple times
*Thread Reply:* My Apple SE suggested we enable AL with our MDM to help prevent people stealing/re-selling. VMware said theyre working on implementing this MDM feature. I didnt realize its in beta until i looked up the command: https://developer.apple.com/documentation/devicemanagement/activation_lock_a_device
*Thread Reply:* i never noticed this feature isnt available in WS1!! It's available in most MDM's already if im not mistaken?
*Thread Reply:* I thought the same. I know other MDMs have it. Whats confusing is based on the link above its still in Apple beta but maybe it has some new changes in beta. WS1 can allow/disallow AL but they arent able to set it. When I opened a VMware case they said theyre working on supporting it though.
*Thread Reply:* Having it in DEP and assigned would prevent use after theft as well.
*Thread Reply:* I’ve also used DEP to catch thieves.
*Thread Reply:* In WS1 we're using this. Isn't this exactly what we're looking at?? It's been there "forever"
*Thread Reply:* I think we saying is that it makes it able to use it doesn’t actually activate it
*Thread Reply:* Although if you enable that and then are allowed to use find my iPhone on the iPhone wouldn’t that actually just turn on activation lock?
*Thread Reply:* I’ve never actually tried because I’ve never actually enable that setting
*Thread Reply:* Hey @Peter Mohr that setting is to allow/disallow the user to enable AL. WS1 doesnt support enabling AL via MDM during DEP enrollment
*Thread Reply:* looks like SimpleMDM supports MDM enabling AL and their description of it is, well simple. https://docs.simplemdm.com/article/124-activation-lock
*Thread Reply:* I mean technically there is no actual setting on the iPhone that turns on activation lock, activation lock simply gets turned on via find my iPhone. Turning that setting off just tells iOS that activation lock is not allowed so it doesn’t turn it on.
*Thread Reply:* @brob true, WS1 doesn't enable AL. But with this setting I can allow the user to enable AL (or not). User can always use "Find my"... just without the AL...
*Thread Reply:* How would WS1 turn on AL. To which AppleID?
*Thread Reply:* Simple MDM is saying that you need an Apple ID and password set on the device in order to use it. That means you have to sign in iCloud which means you turn on find my iPhone that you cannot just turn on activation lock on its own
*Thread Reply:* Ahh. got it: If activation lock was enabled by SimpleMDM at the time of device enrollment, the Apple ID of the administrator that generated the Automated Enrollment (DEP) server token within Apple Business Manager may be entered.
*Thread Reply:* We were having a lot of employees trade in DEP iOS devices at Apple Stores. I reached out to my Apple SE to see what we could do and he said we should use our MDM to enable AL so the Apple Stores wont accept the trade ins anymore. VMware said theyre working on supporting it
*Thread Reply:* Weird that Apple doesn't just check to see if the device is DEP enabled and then don't offer trade in
*Thread Reply:* no kidding, i was surprised that they dont
*Thread Reply:* i havent heard of anyone trading in a mac but i dont see why they couldnt
*Thread Reply:* I guess that is what this is for then:
*Thread Reply:* ah nice, what cn is that. i just checked cn135 and i see where i can enable it…
*Thread Reply:* You are trying to solve an hr problem with a policy that will make other issues, a better tack may be the fact your employees have a fraud problem saying the device is theirs
*Thread Reply:* ah, cn135 is on of the dev cns and its on 20.6
*Thread Reply:* So you need managed Apple IDs I imagine.
*Thread Reply:* I’m still at a loss why apple Stores would take a device that comes up with remote management 🤷♂️
*Thread Reply:* I don't think you need MAIDs. Just the admin/DEP token MAID
*Thread Reply:* I wonder if that is policy or a badly trained store
*Thread Reply:* i agree with everyone 🙂 i dont see the harm in forcing AL although id have to test it
*Thread Reply:* Retail isn’t the best at following policy
*Thread Reply:* i checked and none of the stores check for DEP
*Thread Reply:* The harm is when devices get wiped they get asked for the password
*Thread Reply:* Also moving devices between users becomes a real mess
*Thread Reply:* And then Apple has the power to remove it from DEP. that’s just maddening.
*Thread Reply:* yeah true, not sure about how to handle that. i guess we could get the bypass code but thats a help desk call at least
*Thread Reply:* agree, whats worse is we have no indication when apple or carrier/resellers remove devices from DEP
*Thread Reply:* adding tons of complexity and failures (those codes do not always work) without much reward
*Thread Reply:* Yeah. Bypass can be obtained from the console. Provided you don’t delete the record, even after unenrolling.
*Thread Reply:* The real thing to address is why your workers are stealing phones in mass
*Thread Reply:* Interesting chat fellas. Gets some ideas in my head :)
*Thread Reply:* good point Stephen. i’ll bring this up to my manager. Apple recommended it as a way to prevent stealing so trying to follow through with investigating/testing
*Thread Reply:* right I agree, people are stealing and HR needs to take action regardless of what IT can do
*Thread Reply:* It is worth noting I come from a protect the data is key, not really caring about the devices value mindset
*Thread Reply:* Yep, the devices are cheap in my shop. .99 cents cheap.
*Thread Reply:* in all but rare ones yep, they can buy the expensive ones but almost no one does
*Thread Reply:* And if you don’t have it when you leave or need an upgrade. We make you pay the replacement cost which is full value.
FYI An excellent discussion of ways to distribute internal apps: https://mobilxperts.slack.com/archives/C1V75UE76/p1590150374343500
Sharing here too! https://mobilxperts.slack.com/archives/C1V75UE76/p1590743160456300
*Thread Reply:* Do you remember the thread I created around this a while back about managed apps being offloaded? Crazy...😆
*Thread Reply:* So is Apple going to include a MDM control to prevent managed apps from being offloaded?
*Thread Reply:* That’s the idea however unsure as to how they are going to achieve that exactly!
*Thread Reply:* I bet my balls that they will include the control only for Supervised devices...!!!
*Thread Reply:* I already told them that this doesn’t concern supervised devices in our case so it’s a “global” change.
*Thread Reply:* I also just checked my supervised test device and I don’t see an option there to offload unused apps
*Thread Reply:* Unless that is controlled by some obscure setting in the restrictions profile
*Thread Reply:* I def recall hearing that if it was a managed app it wouldn't get offloaded. Crazy this is still an issue. Did this recently regress in an iOS 13 release?
*Thread Reply:* It’s been like this forever...the fact that one of our VIP users got wiped due to the compliance policy based on hub being removed was the last straw...
*Thread Reply:* Just got confirmation from Apple that this is fixed in iOS 14 beta which was released last night! Need to test ASAP
*Thread Reply:* Detect via MDM or MTD. Prevent stop unknown developers, unknown sources, ADB (simply stop sideload and debug). Early action via local actions of MobileIron, so no roudtrip over servers are needed. Since the most containers depending on device encryption/security (face/finger unlock, real time notifications, weaker implenentations like Microsoft) wipe on jailbreak is done regardless of container or not.
*Thread Reply:* I would add prevent installation of config profiles by users and - depending on your threat model - also block USB/Lightning data access.
*Thread Reply:* if you need the extra security or have usecases native cant do, use containers. If you want native things like callid in car on iOS simply work and be GDPR conform, native is better. in the end most implementations are mixed.
*Thread Reply:* The containers are tied to mdm, so its not really useful to only look at them
*Thread Reply:* What problem are you trying to solve that needs those to go away since that is not a thing for iPads there is no clear cache or temp files button
*Thread Reply:* User has some how maxed out the storage on the device (all 25gb) so its either an app cache or browser cache. I'm still waiting for a tech to get hands on with the device to get more specifics but trying to figure out options ahead of time.
*Thread Reply:* Also since the device is out of storage its preventing it from taking OS updates as well.
*Thread Reply:* clear cache is not an iOS option, also it is usually pictures browser cache is better behaved than that
*Thread Reply:* Ya this looks to be a specific app that was causing it. Removing and re pushing the app down fixed it for now.
*Thread Reply:* You should post in the #microsoft_endpointmanager channel
*Thread Reply:* Not me. Working fine for us.
*Thread Reply:* Spmetime we have seen. Try resting again and see. And don't push so many apps in auto mode ....
*Thread Reply:* Yes, you can do this in the app config policies
*Thread Reply:* I do not think that option is available. See: https://docs.microsoft.com/en-us/mem/intune/apps/manage-microsoft-edge#utilize-app-configuration-to-manage-the-browsing-experience
*Thread Reply:* I do not see it listed in the app config either
*Thread Reply:* App protection policies or App configuration policies? Yes to both
*Thread Reply:* So if edge browser support app config from the mdm then you should see if there is a key value pair for default search engine in edge. (I assume you are talking about changing the setting in edge browser away from bing to something else like DuckDuckGo?)
*Thread Reply:* Yes: https://docs.microsoft.com/en-us/mem/intune/apps/manage-microsoft-edge#utilize-app-configuration-to-manage-the-browsing-experience
But not a setting to change the search engine
*Thread Reply:* Time to open a ticket with MS. It is kinda up to them to make that option available.
*Thread Reply:* We are attempting to reset the network settings as a troubleshooting step. This isn't impacting many of our phones but enough for them to start asking for help. We are still trying to determine why their laptops are having problems connecting to their iPhone's hotspot but the connection simply fails. Issue doesn't seem to be specific to a certain model iPhones and iOS versions vary between iOS 12 and 13.
*Thread Reply:* Provisioning Profiles can be renew'ed on-to-fly. Certificates always requires a new app deployment. One of the many reasons why Apple actively tries to switch to Custom Apps.... Look at https://developer.apple.com/videos/play/wwdc2020/10667/
*Thread Reply:* thanks @Peter Mohr thought that was the case! I did try to push the csutomer down this route but they are yet to leverage ABM and still quite old school in their deployments
*Thread Reply:* I was getting the error : "MCCloudConfigErrorDomain – 0x80EF (33007) The cloud configuration server is unavailable or busy" on AC2 while trying to add devices to ABM. All my troubleshoot was made with 2 devices, and I finally found that those 2 devices were the issue : 1 was already tied to an ABM tenant (I didn't know about), and 1 was unassigned but not released from another ABM tenant (I thought it was released previously). TLDR; You get this error when you try to add a device that is already assigned or unassigned to a MDM in an ABM tenant.
https://9to5mac.com/2020/09/11/ios-14-iphone-google-chrome-default-browser/
*Thread Reply:* Wonder if they'll incorporate a config to set that remotely via MDM
*Thread Reply:* Nice, I see Firefox and Edge are late to the game!
*Thread Reply:* More like abiding by the rules you are not supposed to support features in beta versions till release per Apple rules
*Thread Reply:* I believe it’s only a profile entitlement so it’s not really a new API, that’s probably why it was published.
*Thread Reply:* Apple broke all my DEP tokens Tuesday when they flubbed the license agreement.
*Thread Reply:* What do you mean by broke? I just accepted the agreement on the ABM - do I need to check something here??? 😧
*Thread Reply:* They were supposed to have the agreement out Tuesday and instead they brok the portal all morning. In that process my tokens were revoked.
*Thread Reply:* How does it show revoked on the console? (checking mine now)
*Thread Reply:* Or if you manually sync from lifecycle
*Thread Reply:* I can only look in DEP for some of them does it say there?
*Thread Reply:* And your new devices would not be syncing
*Thread Reply:* I do dep for groups who manage their own mdm so wanted to check in DEP (yes it is all the same organization don't ask) not seeing revoked and seeing new sync dates in ABM so I should be good right?
*Thread Reply:* I just synced devices on WS1 UEM - no error
*Thread Reply:* They are making changes in ABM and ASM too without mentioning it. Some UI stuff etc. Typical Apple.
*Thread Reply:* I want my field to mass upload serial numbers or spreadsheets back it is not good for trying to process getting rid of lots of devices, also the UI for adding a device by order number got way way worse
*Thread Reply:* Ah @Sharkey so your saying I shouldn't panic that my ABM looks jacked this morning
*Thread Reply:* Yeah. They are changing it all up. Scary
*Thread Reply:* Okay good lol I just linked it to our Intune environment and went to move a device over to start testing and was like WTF did I do lol
*Thread Reply:* Seems you can paste bulk serial numbers into the small field
*Thread Reply:* Ya I searched for the S/N of my test device so I could move it from WS1 to Intune. Hopefully they fix ABM before others in my company notice and call me freaking out lol
*Thread Reply:* How do you get the IMEI search? I did not see a field or get results in the main search window
*Thread Reply:* Download all you devices via csv
*Thread Reply:* seems about right for Apples new UI
*Thread Reply:* @Damian, there’s a setting within Wi-Fi payload for iOS 14 that allows disabling MAC Address randomization.
Which UEM product do you use?
*Thread Reply:* Maybe a Feature Request for your vendor?
*Thread Reply:* We use Airwatch aka WS1 UEM and we already tested this custom xml which works but it’s a false alarm on our end as we weren’t getting the right info - just panicked users
*Thread Reply:* This setting is intended for all those using NACs
*Thread Reply:* so I was surprised while reading you
*Thread Reply:* I use a NPS server via CBA/TLS but there mac address is not relevant
*Thread Reply:* So to confirm, the physical address doesn’t change but you will see the private address checked - it was only happening when users uncheck the wifi connection and if they recheck they are given a private address and lose the physical one - this is the behaviour we are seeing now
*Thread Reply:* I cannot say. Maybe someone using a NAC can confirm it
*Thread Reply:* fwiw Apple did update the ABM release notes last month: https://support.apple.com/en-us/HT208802
*Thread Reply:* Apple mentioned this in the AppleSeed events too
*Thread Reply:* I would have to disagree with their claim of improved bulk management
*Thread Reply:* We had some too. Anyone got any other issue with this update ?
*Thread Reply:* Weird. I had the smoothest/quickest major version upgrade to date. What are the symptoms/issues?
*Thread Reply:* On our side, it was an issue with DEP devices and not iOS 14. Some had to be wiped after the upgrade since they were locked at the authentication prompt. Renewing DEP token solved the issue. I haven't heard about any other issue during this upgrade, except the one about apps not ready for iOS 14 (but I didn't experience an app not working because of this).
*Thread Reply:* Were they getting stuck at an Apple logo or refusing to restore even with iTunes?
*Thread Reply:* What have you been doing to get people going? I have had a couple reports out of a couple hundred updates which is high for Apple
*Thread Reply:* They have to use iTunes to update it and it finishes
*Thread Reply:* Toughest part is iTunes is not allowed on our laptops 🤷♂️
*Thread Reply:* In the APP policies you can enforce encryption. It uses the device encryption which, on iOS, means the user must have a device password. If you set it up that way, MAM enforces a device password, without having to MDM enroll.
*Thread Reply:* You sure it’s possible to enforce a passcode on the « device » without MDM ? I mean have you tested this and not just read a document 😉
*Thread Reply:* Has this always been the case as we setup our infra/policies back in 2017 and were always told we needed to have MDM
*Thread Reply:* obviously you can also specify an app password for the O365 apps
*Thread Reply:* Google are now removing the ability to set a device passcode in WP or COPE in A11 so it looks like app based or container based auth is the way things will go for anything other than fully managed devices regardless of OS
*Thread Reply:* It works differently: you require encryption and MAM Intune SDK encryption on iOS depends on device encryption. Device encryption on iOS requires some form of pin or password. This is default iOS behavior.
Check: https://docs.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settings-ios Quote: “When you enable this setting, the user may be required to set up and use a PIN to access their device. If there's no device PIN and encryption is required, the user is prompted to set a PIN with the message "Your organization has required you to first enable a device PIN to access this app."
This has been the case for a long time already. Dates back to the time APPs supported app data encryption.
*Thread Reply:* So no need for MDM, This encryption rule on MAM just enforces the user to set a pin or password. Works perfectly for some of my customers.
*Thread Reply:* @Paul Conaty we already force the users to set a PIN on all MS apps with biometrics allowed.
*Thread Reply:* I’ll throw something else into the mix here. We also deploy some 3rd party apps which don’t have a PIN ability like MS MAM so imagine we deploy without MDM (we use WS1 UEM btw) and the user decides to install one of these apps without first installing a Microsoft app so no device passcode check!
*Thread Reply:* Have you tried removing the Apple Mail app and then rebooting and reinstalling it from the App Store?
*Thread Reply:* didn’t work 😞. It left all the accounts there, but left it in an “inactive” state
https://micky.com.au/fixing-the-ios-14-battery-drain-problem-will-require-a-factory-reset/
*Thread Reply:* no need... Anyone with a managed appleID can log in to AppleSeed now...
*Thread Reply:* AppleSeed provides access to "Enterprise" resources for beta updates, e.g. change logs & test plans with a focus on features used by companies. You can log in with a managed AppleID at appleseed.apple.com
*Thread Reply:* Hey! No there is no app for Apple ID MFA.
*Thread Reply:* What about some kind of google voip phone app so they can share a number to receive SMS?
*Thread Reply:* I’ve tried in the past to get texts to a similar app from apple and they always failed to send it. They are on to you.
*Thread Reply:* You can add up to 6 cell numbers to the same AppleID
*Thread Reply:* that’s how we do to handle more than 5 admins on ABM
*Thread Reply:* we have added several cell numbers to each admin account. The same limit should apply to regular AppleIDs.
*Thread Reply:* Did anyone tried to setup a Twilio number with redirection to other numbers ? Wonder if that would work
*Thread Reply:* missed this, sorry @Raul.Does it hit all 6 numbers at once or cycle through them?
*Thread Reply:* When you login to ABM, it will prompt you to choose the cell number on the list.
You can add 6 cells to each admin account ( ABM allows up to 5 admin accounts(
*Thread Reply:* Backup from unsupervised device restored to Different Supervised device will be OK.
*Thread Reply:* Backup from unsupervised device restored to same device that now is supervised will break Supervised mode
*Thread Reply:* There was a bug sometime back within iTunes restoring DEP devices. Does it matter if we restore from iCloud or iTunes? But restore only during the setup assistant, and not afterwards right?
*Thread Reply:* Restore only during setup, anything else creates a huge mess.
*Thread Reply:* backup from same device when it wasn’t supervised or from a different unsupervised device?
*Thread Reply:* If you restore a backup from the same device when it wasn’t supervised, you will break supervision
*Thread Reply:* backup from an old device (iphone 7 - non DEP) to a new device (DEP iPhone XR)
*Thread Reply:* That will not break the supervision
*Thread Reply:* But do you know if it will still work through the manual restore process and not an iCloud backup? I don’t have any devices to test just yet so was wondering if anyone had been through this process
*Thread Reply:* What do you mean with Bluetooth? The Quick Start feature? If yes, never use that with devices you want to manage, it‘s build for consumer usage.
*Thread Reply:* Correct. Same applies to moving device from one location to another.
*Thread Reply:* We have tried scalable payment solution in past and it was awful. But that was years ago. Main problem was that Apple was not interested in helping or discussing how solution could be improved (with one of the biggest retailers in UK) We went with Android and custom in house app for tracing and reporting.
Sharing here in case any of you are using Workspace ONE UEM
*Thread Reply:* This was affecting us big time Damian. Thank you for sharing!
*Thread Reply:* We’ve got it running and we like it thusfar.... it does have some downsides even with a small amount of users.
*Thread Reply:* Do you use it with 1:1 deployments? Are you only using it for shared iPad? Curious the use cases you've applied.
*Thread Reply:* Ah, great makes things clear, was a bit confused by the Apple documentation as it mentions to configure SCIM first and than federeted auth. afterwards. So SCIM is an addition to federated auth, but you can't use it as 'stand alone'?
*Thread Reply:* SCIM is for updating user info (create, update, delete) and federation is for authentication (and just-in-time creation of users)
*Thread Reply:* The difference was clear, but after reading several blogs I noticed that SCIM and fed auth were described as separated solution and could function separated from each other, at this point I started doubting. Thanks, have a nice weekend!
*Thread Reply:* Apple have a list on their site.
• iPhone 11 • iPhone 11 Pro • iPhone 11 Pro Max • iPhone XS • iPhone XS Max • iPhone XR • iPhone X • iPhone 8 • iPhone 8 Plus • iPhone 7 • iPhone 7 Plus • iPhone 6s • iPhone 6s Plus • iPhone SE (1st generation) • iPhone SE (2nd generation) • iPod touch (7th generation) iPadOS 14 - Apple (UK)
• iPad Pro 12.9-inch (4th generation) • iPad Pro 11-inch (2nd generation) • iPad Pro 12.9-inch (3rd generation) • iPad Pro 11-inch (1st generation) • iPad Pro 12.9-inch (2nd generation) • iPad Pro 12.9-inch (1st generation) • iPad Pro 10.5-inch • iPad Pro 9.7-inch • iPad (8th generation) • iPad (7th generation) • iPad (6th generation) • iPad (5th generation) • iPad mini (5th generation) • iPad mini 4 • iPad Air (4th generation) • iPad Air (3rd generation) • iPad Air 2
*Thread Reply:* I use Everyi.com for their Maximum iOS Version for iPhone, iPad and iPod touch article which seems pretty reliable for older devices.
*Thread Reply:* MDM will not override, but you can’t generalize that OTA updates are not working/allowed over cellular. It depends on the carrier. Some carriers restrict the download and some don’t - It’s part of the carrier settings. Even if the carrier allows unlimited OTA updates (we have 1 here in Denmark that allows that; while the others only allow smaller OTAs) there is a short (2-3 weeks?) blocker where an update is only available on Wi-Fi. After this period the OTA settings kick in. (try to set your date to some date in the future and test :))
*Thread Reply:* @Peter Mohr thanks for the great info!
*Thread Reply:* I looked at the apple forums and saw an issue with attaching pictures in Mail since 14.x. Not sure if that's the same issue you're having.
*Thread Reply:* Thanks for the response Ray about an hour after posting that I got a report from an Android users as well. We are going thru an Exchange upgrade currently and that team is dragging their feet so it appears to be something on their end so will see when they get around to actually fixing it. In the meantime I guess I'll just try and calm down the annoyed users lol
*Thread Reply:* I have used many MDM to manage large and small deployments of Apple devices. Jamf is one of the best MDM’s out there. They are very responsive to new features, they have great automated enforcement, and being “Apple only” lets them focus. They have one of the most complete MDM’s meaning of the “available MDM features” Jamf has implemented most of them. I have used most of the major players (IBM, VMWare, Microsoft, Moysle, Kanji, Meraki, and many others) and Jamf time and again comes out on the top of the list for features and usability.
*Thread Reply:* thanks @Todd Cole - i think im going to spin up a trial and have a bit of a play around with it
*Thread Reply:* Jamf pro is great but you can get a basic idea with the free JamfNow account
*Thread Reply:* I think I know the answer to this, but better to ask than to respond incorrectly 🙂
*Thread Reply:* Hey @Barbra Conner look--I’m threading! 😆
*Thread Reply:* My preference is to accomplish this with Home Screen/Dock, and App Whitelist/Blacklist configs. Just wondering if the Kiosk mode was enhanced any more since inception
*Thread Reply:* You can hide/disable apps (internal & 3rd party). All except the “Settings” app. Inside that you can disable many thing a user could click but not all. Perhaps this it good enough for your use case?
*Thread Reply:* @Peter Mohr Is what you described attainable using Kiosk or was that via the other configs I mentioned?
*Thread Reply:* Just trying to determine if there’s any superiority to using Kiosk vs all the individual configs
*Thread Reply:* Its a restriction policy… We use it all the time on shared devices
*Thread Reply:* Okay, that’s the angle I’ve been working as well
*Thread Reply:* So “Multi App Kiosk” but done using misc configs instead of a singular config (Like Single App Kiosk)
*Thread Reply:* only real issue is the settings app. Lock as much as you can down with restrictions and hope for the best 🙂 Generally works fine. You can always find fingers that wants to toggle anything… This is not Single App Mode…
*Thread Reply:* Temporary session on Shared iPad might be interesting to consider
*Thread Reply:* Not according to the documentation on configuration profiles
*Thread Reply:* @Mark Vonk Yeah, that’s what I’m seeing. Apple pretty much prevented it from being touched all around on iOS/iPadOS (unless the user goes in and manually changes it)
Am 26.1. Gibt ein drei Tage Seminar (ONLINE) zu iOS 14 (MDM, ABM, ....) https://www.comconsult-akademie.de/ios-im-unternehmen/
Hello, anyone impacted by the iOS 14.2+ and MDM-deployed app crashing issue? https://github.com/xamarin/xamarin-macios/issues/10086#issuecomment-738237870 We've been dealing with this for a while, and haven't heard really any updates from either Apple or MS, aside from the blame game. Current fix is to stop distributing app from MDM, direct user to public app store to download app, works every time, just hard in dedicated device scenarios where no iCloud account exists and the app stores are blocked.
*Thread Reply:* I know I'm late to the ball on this ... but yes, we're in the same boat. We had to go back to the developer of our app and ask them to fix the issue. The biggest issue for them was the "trampoline" issue. We're hoping that this week they'll release the update that's going to fix this for us. To add, we tried other alternative solutions, nothing worked.
*Thread Reply:* anyone got any idea when this will go GA
*Thread Reply:* My Apple POC advised that this was a developer issue. We went back to the developer and they advised that they were working on the "trampoline" issue that will fix this issue. The app update is currently in the works and hoping that an app update is coming out this week for this.
*Thread Reply:* I guess they don’t have to fix “trampolines”. Just update to 14.4 tomorrow
*Thread Reply:* @Jordan Philip thought you'd like to see this.
*Thread Reply:* Update ... still no iOS 14.4 for today
*Thread Reply:* @Ray Domingue I guess we just had to be patient https://www.theverge.com/2021/1/26/22251149/iphone-update-14-4-fixes-exploited-security-vulnerabilities
*Thread Reply:* Definitely, i’d say host the website on www and your app on api. You don’t want to use www for both, as it might be two different servers (like a wordpress for the www and something else for the app)
*Thread Reply:* Using two different domain mydomain.com and yourdomain.com will end up being a nightmare for user tracking, sessions, seo ...
*Thread Reply:* @Jeremy agree on all fronts! Thanks for the response. I know the design of the app isn’t technically in our realm, but I’m trying to provide guidance as best I can
Friends! Ayone with similar experience with managing iOS updates in MDM? https://mobilxperts.slack.com/archives/C1V75UE76/p1611907747036100
}
*Thread Reply:* I'm currently using this feature now in WS1 and have been ever since they released the ability to do so. For us at least its been pretty straight forward and typically works with little to no issue. Only time I normally see failures is if the battery is too low, device is low on storage, or they are on cellular and once the device connects back to Wi-Fi it usually corrects its self and completes.
*Thread Reply:* The one issue I have with this setup though is I can't force it to devices that have a lock screen pin enabled. On those I can push it down and have it ready but like you mentioned the user than has to accept the update before it will install. I wish we could both force that and force the download over cellular so I could get these updates rolled out quicker.
*Thread Reply:* Don´t you ever get the "Unable to install..." error message (see images)
*Thread Reply:* If users are seeing that it's never been reported to me. Also as you can see I started my roll out of iOS 14.4 on two days ago I first deployed specifically to a small group of iPads that actually needed 14.4 to fix an issue with an app developed on Xamarin platform along with a few other smaller test groups. The mid afternoon yesterday once I was sure it wasn't causing any issues I pulled that deployment and re-deployed using a smart group I created to push this to all available devices corporate devices and as you can see from the screen shot its flying thru them pretty quickly all things considered.
*Thread Reply:* It's possible the devices that are showing as failed are getting that error but I'm going to assume they are not at this point because when I look up that list they are all cell phones used remotely and that team has been instructed to keep Wi-Fi off when out and about doing their job because other wise it breaks their VPN connection (or so I'm told) so in order to stay connected and avoid multiple logins they stay on cellular all day long but are supposed to connect to Wi-Fi when they get home at night and pull down any pending updates. They clearly don't do that every night or I wouldn't have so much red on that chart 😄
*Thread Reply:* Also we are a SaaS customer on Version: 20.11.0.7 (2011) not sure if that matters or not but worth sharing since you are running into issues. Maybe someone smarter than me here will chime in with what might be causing your issue.
*Thread Reply:* Although this is what MS advices us to do, I believe it is the worst practice since it also requires you to modify your conditional access rules. You will need to allow ActiveSync so be sure to also implement a check if the new ActiveSync profile is installed. If not, it could mean that the user already created an actuvesync profile manually, allowing him to also sync mail and calendar data to the native apps.
Unfortunately this is the only solution that will work for most users.
*Thread Reply:* Well, you can disable ActiveSync with username password allowing only CBA and you can send down the profile with just contacts and disable the user from enabling email and/or calendar). I think we can greatly improve usability here by following this pratice.
The Outlook => native sync is the worst experience ever. Both in terms of user experience but as importantly security wise.
*Thread Reply:* Absolutely agree! Especially since Outlook --> native sync of your contacts uses iCloud and therefore syncs all your business contacts to ALL your i-Devices that use the same iCloud account. Also to devices that are unmanaged.
*Thread Reply:* @Peter Mohr how would switching to CBA and disabling username/password affect other systems using the ActiveSync protocol? For example, right now our old MDM we're retiring uses ActiveSync for email access. Its also been mentioned that our Teams rooms devices might be using the ActiveSync protocol for their scheduling.
*Thread Reply:* Yeah, you still need ActiveSync protocol.. It comes with auth in three flavours
- Basic Auth - Username/password
- Basic Auth - Certificate Based Auth
- Modern Auth - “web login” You should disable #1 and only use #2 (and perhaps #3)
*Thread Reply:* It is getting complicated when you configure the new “partner compliance” between 3rd party MDM (like WSO UEM) and AAD (Intune) and enable Conditional Access Policy on AAD side to require compliant devices only. After device enrollment you need to push Exchange payload (with contact only) ASAP to avoid the possibility that user will add account manually… The issue is that user will get authentication prompt for Exchange waaay before MS Authenticator is installed/account added/device registered to AAD. So authentication will fail. CBA will not help in this case as well… To be honest it is nightmare from UX perspective.
*Thread Reply:* You can prevent this by creating a compliance policy that checks if the mail configuration that you wish to push to the devices is installed. If not, quarantine the device.
*Thread Reply:* @Almar Diehl device is not managed by Intune but WSO UEM
*Thread Reply:* Basically WSO UEM is just flagging device as compliant/non-compliant in AAD. Only MS Authenticator can register device in AAD and then pass AAD Device ID to match to that device record so all auth traffic must go through MS Authenticator.
*Thread Reply:* @Ladislav Blazek Are you using Outlook as the mail client for WSO UEM devices, or a third party client? In ActiveSync you auto-approve based on agent version on device.
*Thread Reply:* @Travis Reeves Outlook as the mail client, native iOS app for Contact sync (Exchange profile with just contacts enabled). There is Conditional Access Policy configured on AAD side to allow compliant devices only. So agent filtering on Exchange for EAS will not help. The problem is that MS Authenticator needs to be installed together with SSO Redirect Extension (using MS Authenticator plugin), user need add company account to MS Authenticator and then register device to AAD. All this will take some time… But Exchange profile is applied immediately after enrollment and user is prompted to authenticate. Authentication will fail again and again… until all the previously mentioned steps related to MS Authenticator setup are done.
*Thread Reply:* So basically my recommendation at the beginning for that customer was avoid Outlook contact sync and use native contacts synced via Exchange profile instead… now trying to figure out how to make that process user friendly during device enrollment, but I don’t see an easy way.
*Thread Reply:* We push an EAS Contacts only profile via MDM using CBA for Auth and block all other Auth at the Exchange Online layer. This way native caller ID is there and access is available to managed apps with the iOS restrictions. Outlook iOS is there for email, calendar etc
*Thread Reply:* you can just amend your privacy settings in the OG that the devices sit in and untick the box as shown in the image to not collect app data
*Thread Reply:* Yes I know that - it’s what we currently do with COPE devices. However my question is if the devices are supervised, does that setting take priority or are all apps (not just those which are managed) shown on the console ?
*Thread Reply:* if I remember rightly, I believe this doesn't show any app that is not pushed out via VPP. So if a user download an app from the app store, you will not see it in the list if this box is unticked.
*Thread Reply:* I’ll do a series of tests to double check
*Thread Reply:* Privacy policies have 0 differences on supervised vs unsupervised iOS devices.
*Thread Reply:* Difference is only on VPP and restrictions (and some payloads like wallpaper or layout folders)
*Thread Reply:* But you will not see anything else different from what the privacy policy allows/gathers
*Thread Reply:* It’s just that if you also use VPP, your users will be happy to see seamless app installation
*Thread Reply:* Thanks that’s what I thought!
*Thread Reply:* We are since it was confirmed that one of the exploits had been used in the whiled. Also our deployment of Corp iPads is pretty small compared to a lot of people in here so the risk is pretty minimal to us. We actually needed iOS 14.4 to drop as it fixed an issue with apps built in Xamarin which a few of our vendors use so this actually fixes multiple things for us besides the security patches.
*Thread Reply:* Our security team wants 60k devices updated to iOS 14.4 within 7 days....they’re living in a fantasy land.
*Thread Reply:* I know the feeling! We’ve also been given 7 days for the 7k devices...but our group manages over 100k on other WS1 tenants !
*Thread Reply:* In the capacity of a MSP.. we’re strongly advising it. When there are 3+ critical vulnerabilities it always gets the Nike “Just Do It” approach
*Thread Reply:* This thread just got me curious is there an easy to push out iOS 14.4 to all devices in Intune. I know WS1 made it pretty simple but since we pumped the breaks on Intune as a company at least for now I'm curious if MS put something similar in place.
*Thread Reply:* @Boe Yeah, they’ve got it in there now (at least as part of “Endpoint Management”
*Thread Reply:* Yup down for me as well must be doing some sort of maintenance again or something
*Thread Reply:* Are you guys using it while connected to VPN? Usually I see that screen when I access ABM with VPN on. Once I turn it off I do have access to the Apps and Books part.
*Thread Reply:* Nope, tried with multiple open Wi-Fi including LTE hotspot.
*Thread Reply:* Confirm. Had to accept T&C and then same screen a Eric.
*Thread Reply:* What's funny is that it shows as Up and Running here : https://www.apple.com/fr/support/systemstatus/
*Thread Reply:* Always knew that thing was updated manually.
*Thread Reply:* I have two instances, trying the second one now.
For those that are using app protection policies (w/ Intune) ... !! https://www.reddit.com/r/Intune/comments/lb0y95/ios_145_breaks_apps_that_are_app_protected/
*Thread Reply:* Hopefully they fix it by the time it goes GA or we are all in for a rocking good time 😛
*Thread Reply:* Agreed, but still I don't need this. SMH.
*Thread Reply:* I ran into that issue yesterday and was expecting some communication about this
*Thread Reply:* If you have an AppleCare support agreement they can provide an EAS specific profile to capture sysdiagnose logs…
*Thread Reply:* Deploy one or more of the debug profiles from https://developer.apple.com/bug-reporting/profiles-and-logs/ and then have the user generate a SysDiagnose in one of two ways… Buttons or AssistiveTouch.. https://download.developer.apple.com/iOS/iOS_Logs/AssistiveTouch_Sysdiagnose_Logging_Instructions.pdf
*Thread Reply:* Sysdiagnose logs can help too: https://www.jessesquires.com/blog/2018/02/08/how-to-sysdiagnose-ios/
*Thread Reply:* Dedicated Corporate devices fully managed via WS1/ABM.
*Thread Reply:* We use a mix of compliance policies which includes notifying the end user via push and e-mail and pushing updates and within xx days removing mail access if device isn’t updated
*Thread Reply:* Ya I actually just put a compliance policy on a group of them to block email access until they update their device since the users just ignore our email / hub notification requests lol. It's just frustrating Apple doesn't give us the ability to force the install/reboot like you can on a device that doesn't have a lock screen pin.
*Thread Reply:* we use a mix of compliance policy and conditional access policies in MEM. user get a grace period of 7 days to update to the requested OS, after those 7 days access to company ressources is blocked on the device
*Thread Reply:* @Boe you don't say ... they ignore your email??? #ThatsMyLifeTooEveryday
*Thread Reply:* We're going to start doing this as well in Intune, the problem is we have users that live in remote areas and not only do they not have Wi-Fi in their home, but they are not allowed in the regional offices b/c of Covid-19. So we're having to think outside the box on this.
*Thread Reply:* I wish you the best of luck on that sir, it appears Apple has made this more of a pain in iOS 14 now requiring the device both be on Wi-Fi and plugged into power in order to update. Come on Apple I thought you were supposed to be the ones all for keeping things simple lol
Can anyone else confirm if you’re seeing this “lack” of control/behavior with Shared iPad for Business in other MDMs?https://www.reddit.com/r/Intune/comments/llr25e/shared_ipad_for_business_change_inactivity_lock/
*Thread Reply:* You can change the timeframe with your mdm
*Thread Reply:* @iMZ it may be that InTune is lacking support for several shared iPad features, but so far everything pushed via MDM is ignored.
*Thread Reply:* If there were any errors uploading to your portal you would receive an email from Apple. If you haven’t received these errors then like Peter says they have probably uploaded to the wrong portal.
*Thread Reply:* Hi, alternative could be encrypted backup using iTunes.
*Thread Reply:* The best way to do is to retire device from UEM, make backup, and then restore to new supervised device
*Thread Reply:* You can't unenroll a supervised device without wiping it, or I have missed something recently 🤔
*Thread Reply:* Correct, you’d need an admin to issue a “Retire/Unenroll” command from the console.
*Thread Reply:* But the device would still need to be wiped.
*Thread Reply:* No, you just want to pull the MDM profile, but you can def do the backup after retiring device
*Thread Reply:* I don’t think that’s it. I believe safari gets its passwords from the keychain. So “keychain” is what you want to enable.
If a device has an Apple ID and iCloud then this option changes to “iCloud Keychain”.
*Thread Reply:* Thanks, you're dead right. our users just need to enable 'Keychain' as per the screenshot and functionality comes back
Looks like for our users at least, upgrading to iOS14 disabled this feature so it had to be enabled again.
*Thread Reply:* VPP works regardless of supervision. App is already installed. So if assigned with device license, MDM should be able to send update command.
*Thread Reply:* I’ll have a look at it thanks for the help.
*Thread Reply:* If the app is installed by the MDM then it can update it. if the user installed the app then the MDM can not force the update, however if the MDM takes over the app then it can update it (app takeover has to be enabled in the MDM)
*Thread Reply:* True, good point. Push message to convert app from unmanaged to managed state is supported by nearly every MDM. On non-supervised device user need to approve that conversion = user will be prompted and can decline. But I am right now not sure about one thing... when the app installed by user and is converted to managed state. Could be the license changed as well from user to device licensing model without app reinstallation? Afaik app auto updates works only when device licensing is enabled.
*Thread Reply:* Thanks for the info. Is there a way to follow these case without an Apple care enterprise subscription?
*Thread Reply:* openradar.appspot.com tracks apple bugs (radars), but it doesn't catch them all. I think it is up to the originator of the radar to list it themselves and they haven't in this case (radar FB9010428). We have logged a ticket with AppleCare to see if they can tell us anything further, so I will let you know what they come back with.
*Thread Reply:* AppleCare have acknowledged the issue and are planning a fix in a future iOS release.
*Thread Reply:* thank you. I'll be hanging my hat here from now on 😄
*Thread Reply:* Should we go ahead and just archive all the Android channels?
*Thread Reply:* Couldn't make Android documentation any worse 😛
In case anyone is interested, we’re going to start pushing our devs to incorporate this into all future enterprise apps! https://betterprogramming.pub/how-to-prevent-screen-capture-at-ios-14-1f01173c31c0
*Thread Reply:* @Michael Goad What MDM are you using? This is a good use case for implementing Device Trust. There are several vendors offering this (and several ways to implement), but essentially you’re screening devices before allowing them into managed modern services. If you’re still using ActiveSync, you can toss a certificate auth requirement on top of the connection.. then anyone not managed would automatically be filtered-out/denied access until they become managed.
*Thread Reply:* Anyone have any MS links, about this: • have one customer reporting this (VMware tickets, thought this is some issue with WS1.. but as said: App works if "non-MDM managed, installed from App Store)
*Thread Reply:* Ok, Endpoint Manager - Service Health has the notes from MS. Just took some digging (thanks for the heads up and posting the MobileJon - link.. there was screenshot in the Linkedin post 🙂 )
*Thread Reply:* Looks like it has been resolved by MS.
*Thread Reply:* Anyone have insight on this one? My gut says the migration wizard would port over the Apple ID and the user wouldn’t be prompted?
*Thread Reply:* Are you referring to iOS QuickStart (https://support.apple.com/en-us/HT210216) ? In that case I think the fine print at the bottom of that page may be relevant to your question: “** If your new iPhone is enrolled in Apple School Manager or Apple Business Manager, you can’t use Quick Start to transfer data from your current iPhone.”
*Thread Reply:* @Thomas B. Yeah, this was posted before I got down into the details. Company isn’t going to buy iCloud storage plans for backups, so if a user happens to have an Apple ID and backups.. they can restore. Else, the new device is provisioned with a baseline of business apps and user can add extras as they go.
*Thread Reply:* For CSuite/Exec level… may exclude new device from DEP Server assignment and allow use of the Migration Wizard.. then User Enroll into MDM after the wizard completes.
*Thread Reply:* That would work. Also, local (‘Itunes’) backup can sometimes be an option for those without sufficient iCloud storage. If you happen to have a contact with a local friendly AppleSE they might also be able to help you ensuring you consider all options.
Another week another iOS exploit 😄 I kid but man it seems like this is becoming a weekly thing lately https://www.theverge.com/2021/5/3/22417984/ios-14-5-1-ipad-iphone-apple-watch-mac-update-security-fix
*Thread Reply:* I thought the same. Should have let some of the betas bake a little longer. Glad I skipped 13.3.0 on MacOS, since it comes in at nearly 6.5Gb (and would have been nearly 13gb of updates after doing 13.3.1)
*Thread Reply:* I think it was just new emojis 🥱😶🌫️ 😵💫
*Thread Reply:* …one of which is not working as intended. Anticipate another update soon 🤣
*Thread Reply:* Ya even my die hard iOS friends/co workers are getting a little annoyed by this. 3 out of the last 5 updates are to fix exploits. So much for Apple Security being superior 😄 In all fairness they make great products but this is starting to feel like iOS 13 all over agian.
*Thread Reply:* Maybe the security team was distracted by the Gates divorce 😆
*Thread Reply:* i think this is a good overview https://developer.apple.com/videos/play/wwdc2020/10667/
*Thread Reply:* I quite like the table of distribution options published here at the end of the page: https://developer.apple.com/business/distribute/
*Thread Reply:* Also, that page links to pages with more detail on both the Enterprise program and Custom apps respectively, e.g. https://developer.apple.com/custom-apps/
*Thread Reply:* thanks @Thomas B. thats exactly what i was looking for
*Thread Reply:* Hi Leon. This is where iOS stores the data value for traffic related to the EMM. Check-in's are negligible, but this could be related to an initial sync of a large mailbox(s) or if there is a configuration error in the work-stream w/ the EMM, it could be constantly throwing errors back to the service. Sometimes just doing an unenroll/reenroll can solve these issues as well. Here's an Apple Support article on what some folks have done to find the resolution. https://discussions.apple.com/thread/5386573?answerId=23327904022#23327904022
*Thread Reply:* Very useful - many thanks. My initial thoughts were to take a look at the mailbox settings
*Thread Reply:* Yeah we have auth off when the device is first enrolled and then put them in a lost mode with auth on so they can’t advance. I guess it’s the only option?
*Thread Reply:* What are the password requirements that are pushed?
*Thread Reply:* but we managed to resolve it by creating an alphanumeric passcode which isnt in the policy but allowed the user to continue to reset it then set it back to 6 digits after
*Thread Reply:* That’s weird. I have seen similar issues, but only when the password policy forced extreme password complexity
*Thread Reply:* When plugin the iOS Device to a Mac, you can use the console application to see the logs
*Thread Reply:* look for the package name of the application you should be able to retrieve the correct log
*Thread Reply:* We usually see this error message when the app is not correctly signed (AdHoc or AppStore) instead of InHouse
*Thread Reply:* <windows geek> Anything comparable for Windows? 😄 Time to try and scare up an Apple computer
*Thread Reply:* Use Sysdiagnose to get the log file and open on any computer :)
*Thread Reply:* I have used this in the past, before I switched to a Mac:
1. Download the full set of exe's and dll's
- Create a folder named “DeviceLogs” in the root folder of you local C drive.
- UnZIP the download to the C:\DeviceLogs folder.
- Click “Start” in the search window type “powershell”
- Type the following commands: cd \DeviceLogs ( hit enter ) .\idevicesyslog.exe | tee LogName.log ( hit enter ) Reproduce the issue and hit Ctrl+C to stop the log capture. LogName.Log file will be located in the C:\DeviceLogs folder. NOTE: 1) Device must be unlocked prior to running either command. 2) You need to have iTunes installed on the computer.
*Thread Reply:* Yep we ran a POC but as we do mobileSSO and federated our domain with ABM, this created an extra hurdle as our IDP sends any mobile user-agent to WS1 Access (this includes Safari that is used for end user enrollment). As the auth request comes from Azure, this impacts all Office mobile apps so we couldn’t put an exception in place to not forward the request for end user enrollment without impacting the security of the solution. There is a way to ensure conditional access between AirWatch and AAD but you need MS Authenticator for this and we already have our own Authenticator app…send me a PM if you want more details?
*Thread Reply:* We found an issue with per-app vpn (cert based auth). This is not possible with user enrollment. As we have the requirement for some apps with internal backend to use a per-app vpn this was the show stopper for us. Haven't looked into this for a while now to be honest but I believe this did not change yet.
*Thread Reply:* @Cedric Lüke I can't imagine we are the only ones looking at it. I would also like to think someone in here has already made the switch. I was watchin this session from WWDC where they are talking about the change to declarative management that got me thinking about it again. https://developer.apple.com/videos/play/wwdc2021/10131/#:~:text=Declarative%20management%20allows%20the%20device,without%20prompting%20from%20the%20server.
*Thread Reply:* I swear on one of the initial builds I did, it was feasible. However, what I’m seeing here says that ABM will always enforce a complex passcode? https://support.apple.com/guide/mdm/shared-ipad-sign-in-mdm6c592d817/web
*Thread Reply:* Why share a passcode, use a guest login? Just curious.
*Thread Reply:* @Todd Cole Customer was against Guest/Temporary, as the users need to be signed-in as themselves and be able to retain app data/settings/etc.
*Thread Reply:* Shared iPad with Managed Apple ID’s? Let's talk tomorrow if you are free, I feel I am missing something here.
*Thread Reply:* Yes @Todd Cole - Shared iPad with MAIDs.
*Thread Reply:* I’m free to chat this afternoon at any point. You know how to find me #Holler
*Thread Reply:* With iOS profiles, it is a remove and re-install of new profile. Apple doesn't support a concept of deltas.
*Thread Reply:* We use Workspace ONE and we just updated the EAS profile with Oauth enabled and the iOS device received a pop-up asking them to enter the password which takes them through the auth workflow
*Thread Reply:* That would be great feedback to share via the Feedback app / AppleSeed for IT as a feature request…. maybe talk to a friendly Apple SE to see if they can help raise the visibility of your request…
*Thread Reply:* Able to ask their support team if the app implements AppConfig? Also ask them why not if it doesn't.
*Thread Reply:* I wish unfortunately this app is provided to us by a vendor and not the company direct so I don't have direct access to their support which is why I thought I would reach out and see if anyone else had experience with it. I went thru their support site and they mention MDM's in some of their documents but never anything about supporting AppConfig via the MDM. It's not a huge deal either way I was just hoping to cut a few setup steps out for our Desktop Support Team, plus less things they have to manually do less chance for error 😄
*Thread Reply:* The Google Play version does not support AppConfig.... so that isn't a great sign.
*Thread Reply:* Ya I checked that too so I figured I was out of luck but thought it was worth the ask regardless thanks for trying though Dirk
*Thread Reply:* no it should work on unsupervised devices as well
*Thread Reply:* My pre-coffee brain can't wrap my head around Apple still allowing for unsupervised unlocks - thank you for confirming!
*Thread Reply:* Do you mean that notifications still come through even though they are not supposed to? Haven’t tested that so far.
*Thread Reply:* It works as expected for me on iOS 15
*Thread Reply:* Actually I have seen this with upgrade to 14.7 too. The persons that where causing this issue had to remove and reapply the exchange config. Native iOS mail right?
*Thread Reply:* Seems somewhat common. But MSFT didn't care lol.
*Thread Reply:* MTD does not replace OS updates, but most MDM would be able to detect devices that are not up to date, and they could push out OS updates to supervised iOS devices, for example MaaS360 can do this.
*Thread Reply:* Of course not, I'm well aware of that - I was just wondering how everyone is managing this given the constant flow of iOS updates…
*Thread Reply:* I put a 21 day hold on updates unless they are critical. I also use mdm to push updates. But as a parallel measure we set devices to auto update on setup as well. Then we preach keeping them updated. Updates on mobile, android and iOS, are spotty for people for many reasons. Most of my population does not like to put a device on Wi-Fi. And we don't have cert based authentication, so auto attachment to a corporate Wi-Fi is not possible. Many updates don't get done due to this. Then there are space issues on devices that prevent updates. Really the best policy I have is to be really annoy the end user until they update. Being annoying is increasingly difficult lol. Good luck 🍀 !
*Thread Reply:* We usually have N-2 as minimum policy and people have a grace period of 7 days (so until iOS 14.8 14.7 would be allowed as minimum, if 14.8 would not have been labeled critical). They get a notification and then have 7 days to remediate, if they don’t do that after 7 days access to company resources is revoked, for that device. With critical vulnerabilities increasing on iOS side we have lately been following going to the latest OS version and set grace period to 1 day, with communication being sent to everybody before hand. The scenario with iOS 14.8 and 15.0.2 being out and Apple telling people that they get to choose made even that more difficult. We have a significant number of people on 15+ already and also still a high number on 14.8 afraid to update because they don’t want stuff to break for them, which I understand had a terrible experience with my private iPhone. I tested Filters in MEM and it works fine, so now we’ll fork the policy and ask everybody who is already on 15+ but not on 15.0.2 yet, to update with grace period set to 1 day. Everybody who is still on 14.8 is excluded for now, because communication from Apple hasn’t been really clear if 14.8 is affected too. Tbh the situation is becoming messier and messier in my view.
*Thread Reply:* We've found that it's impossible to get everyone updated within such a short timeframe…not sure how you're managing to do that in 1 or 7 days unless you have a small fleet. We have 60,000 devices!
*Thread Reply:* Hey @Jay I could be wrong but from what I've seen reported there were 3 major zero days reported and the first was patched by Apple in 14.7.1 after the researcher who found them went public because Apple was dragging their feet. It's my understanding that another was patched with the 15.0.2 patch and that it sounds like the last exploit is getting patched in 15.1. So I believe all builds are impacted but I could be wrong.
*Thread Reply:* Currently we have a 30 day hold on users being able to take iOS updates on their own normally this gives me time to watch and see if any major issues are reported in the media or if any vendors come forward with issues as well. I don't worry as much about apps breaking when they are dot releases but I do worry every time we take a major update (i.e. going from 14.8 to 15) as it seems something always breaks. I have a list of apps/configs that I know are most likely to break so I start by testing on them with the right people to put their apps thru their paces. After that I start my phased roll out across our devices and hope for the best. Like everyone else here has said already its important to keep these things up to date. My direct management doesn't really push for me to do this but my security team has requested it and as the guy who it will all fall down on if we get owned I do my best to keep everything as patched and current as I can. 🤣 Managing mobiles devices will be fun they said, its easy they said 🤣
*Thread Reply:* How many devices are you guys managing ?
*Thread Reply:* How are you guys managing Android, patch dates etc ?
*Thread Reply:* Android 9 as minimum, paired with N-2 when it comes to security patch level, from tomorrow on that will be 2021-08-01. Security patch level is updated every month on the third Thursday. Next month we’ll also move to Android 10 as minimum.
*Thread Reply:* Latest is greatest - the most recent iOS release has prio when it comes to receiving patches. Participating in AppleSeed can help with timely readiness.
*Thread Reply:* This is what I usually suggest when doing new DEP setups
*Thread Reply:* I’d say that setting the policy straight away and holding the device until the config has completed should get you here (awaitdeviceconfigured) - If your MDM does not support this, alternatively just set the passcode policy and most users will opt for the default of a 6-digit code anyway, and those who do not will be forced by policy as soon as it lands on the device.
*Thread Reply:* Yesterday evening already, but good to remind people again.
*Thread Reply:* im a day behind i've just come back from Annual leave so just playing catch up still 😅
*Thread Reply:* Done and done! You have to admit, the emails coming from vendors about this are sort of absurd. CRITICALLY absurd 😆
*Thread Reply:* I think the process of having to go in and check for the TOS at random because they don't do it at a set time on the day mentioned is absurd. Then again the fact we have to do it every time it changes is not much fun in general. +1 for Android Enterprise set it up and forget about it lol
*Thread Reply:* You’d have to create a VPN configuration file in Intune using “F5 Access” as connection type, fill out the other required information and under “Authentication method” select “Certificates”. Then you have to go to “Authentication certificate” and select the other certificate you have precreated, the one you see under General -> Device management.
*Thread Reply:* Also make sure to add the custom xml, like so:
<f5-vpn-conf> <prompt-for-credentials>false</prompt-for-credentials> <client-certificate> <issuer>Microsoft VPN root CA gen 1</issuer> </client-certificate> </f5-vpn-conf>
*Thread Reply:* You can see examples of how to set it up here: https://techdocs.f5.com/en-us/apm-f5-access/apm-f5-access-windows-10-using-intune/cf5accesswindowschaptertitleconditional_access.html
*Thread Reply:* Thanks you, i have understood how to do it. i want to know what should i do on the apps side to use the certificate. i use ionic/cordova for my apps
*Thread Reply:* whenever Workday botch an update (seems to happen quite a lot for one of our customers) they do exactly as you say, revert to a previous version but making it a higher revision.
*Thread Reply:* Thanks @Ajay Patel!
*Thread Reply:* You were dead-on @Ajay Patel This corrected our problem, and nice that they rev’d it up to allow us to “upgrade”
*Thread Reply:* Fun one! Good to know that’s how Workday is working it…
*Thread Reply:* Apple Business Store Online will do this for sure. Not all Apple Retail Stores will do it…
*Thread Reply:* Apple Business Store (in the UK) definitely do add to DEP.
*Thread Reply:* You also have the option to use Configurator to add the device to ABM
*Thread Reply:* Right, but for that I need the device in my hands, which I have not. 😜
*Thread Reply:* The business team in any retail store should be able to help - you’ll need to call/chat/mail them though - walking into the store and getting an ABM enabled device ‘on-the-spot’ is a different story.
*Thread Reply:* There are a lot of problems when restoring to the same device
*Thread Reply:* In most cases it is restoring to a new device, restoring to the same is rarely done here. But the tests I did with restoring to the same looked fine, at least this time.
*Thread Reply:* Yes, I agree with you, Julio. I do face similar issues consistently.
*Thread Reply:* Even the “Quick Start” option worked for me, even though this was multiple times mentioned as not built for enterprise. Very confusing and frustrating.
*Thread Reply:* Julio I'm with you on this, we run into this issue all the time with our BYOD users where they transfer their data from their old phone to their new phone but then can't get enrolled because it copied over part but not all of their MDM profile to the new device. This leads to a support call because most users don't realize and don't want to deal with the WS1 self service profile to nuke their old device. Doing so fixed the MDM profile and then they get enrolled but I wish this didn't happen at all.
*Thread Reply:* Maybe to clarify on Quick Start with ABM - Most of the quick start functions will work, it’s just the direct device-to-device data transfer part that does not - you’ll be guided to use the regular backup-based data transfer- which is fine, esp now with iOS 15 where you get unlimited temp storage for such transfers. Hope that makes sense.
*Thread Reply:* Yeah, I get your point Thomas. That was also my observation, that the device to device transfer is also moving over the profile, which is excluded if you do it in another way. Moving over the device is creating issues and would have to be removed by me through unenrolling the device later, without wiping it if it evens get to reach the home screen
*Thread Reply:* IBM has a nice overview about this :
https://www.ibm.com/support/pages/dep-ios-backup-and-restore-guide
*Thread Reply:* Thank you so much! I knew this image from somewhere, but couldn’t find it anymore. I didn’t know that there was a whole article that it comes with!
*Thread Reply:* Ola Woody, probably yes. got sort of the same response in another Slack channel. Will need to test this, hoped there was an easier way.
*Thread Reply:* @Sidney It's honestly pretty straightforward. Once you do it a couple times you'll come to enjoy it
*Thread Reply:* I had a similar issue. The app needs to be allowed the permissions first. And the permission prompt only comes up when not locked. So we have them unlock the app. Accept the permission. Then lock up again.
*Thread Reply:* Awesome, will try that... thanks!
*Thread Reply:* This would be fairly consistent with what I'm seeing. The one detail that I don't have is when the devices in question were updated.
We have found that repushing the profile fixes the problem for the device in question.
*Thread Reply:* Apple told us it is fixed in iOS 15 beta 4. We can't really test that because it does not always seem to happen.
*Thread Reply:* Thanks to all that contributed to this question. Some times it is nice to know that you're not just crazy.
*Thread Reply:* A question from one of our techs, "15.0 beta 4 or the just-released 15.2 RC (that is beta 4)?"
*Thread Reply:* Maybe check this one; https://support.apple.com/kb/HT212962
*Thread Reply:* Should be fixed in the just released 15.2
*Thread Reply:* Definitely not fixed, but thanks for the ammunition in my ticket escalation.
*Thread Reply:* Thanks for all the info, the bit about it taking more then one Cert to trigger the problem is interesting. It would explain why we're not seeing it on all our servers
*Thread Reply:* Today’s beta contains a fix that looks like it might address an issue where users are prompted to select a certificate to authenticate to websites several times before gaining access. - might be worth looking into.
Has anyone played around yet with Configurator for iPhone? Just realized it released a week ago. Gonna have to give it a shot.. https://9to5mac.com/2021/12/06/apple-configurator-now-available-on-iphone-for-adding-macs-not-purchased-by-an-organization-into-business-manager/
*Thread Reply:* I think that’s a good start. The whole thing works very well, hope Apple brings additional features in there.
*Thread Reply:* Single app mode is the equivalent?
*Thread Reply:* Yes we could configure Single app mode with MDM, but not really the same like Guided Access
*Thread Reply:* Ok, looks like there are payloads:
*Thread Reply:* Why not cache them locally with a Mac Mini or similar? (Also makes iOS provisioning much faster too) 🤔
*Thread Reply:* Interesting- how would that work in combination with MobileIron Core?
*Thread Reply:* Jason is talking about the macOS caching server option. That feature is independent of the MDM used. The iOS device would need to be on the same network as the caching server when running the updates.
*Thread Reply:* I see. Thank you, I will take a closer look. But basically the clients need to know that Mac Mini is the source for updates, am I right with that?
*Thread Reply:* No client settings are needed, they just need to be on the same network. This feature is built-in to macOS
*Thread Reply:* Sorry, been in meetings, but Lewis is spot on.
*Thread Reply:* User Enrollment? User Enrollemnt has no supervised Mode or what do you mean?
*Thread Reply:* On the other Hand a device that was once supervised is Supervised until you remove it via Apple Configurator ;) no matter how the mdm changes
*Thread Reply:* Okay! It had been a minute since Supervised, then retired and added to a new MDM (without wiping/starting over). Thanks @iMZ for the refresher
*Thread Reply:* To clarify: If I'm migrating a supervised device from MDM A to B without a wipe, I want to make sure the Supervised Flag carries into MDM B
*Thread Reply:* When enrolling to MDM B, it is technically User Enrollment, because the user is enrolling... not Device Setup Wizard
*Thread Reply:* Ahh this way! If you do this, the device is also flagged in the new MDM supervised
*Thread Reply:* Is just like with an ACC to bring the device into supervised and then log in to MDM.
*Thread Reply:* Is it really a “User Enrollment” (with managed Apple ID) or do you mean a user initiated enrollment through agent @Woody?
*Thread Reply:* Yes @Jay it technically is perceived as a User Enrollment
*Thread Reply:* There is no MAID in this scenario. Basically a the MDM being removed from the source system, then being left without MDM.. so the user goes out and installs post-deployment, which is perceived by Apple/iOS as User Enrollment
*Thread Reply:* I get that, I’m just confused by the usage of “User Enrollment” as Apple tried to change it into this enrollment scenario that has to include MAID even though before MAID the same term was and obviously is still used for BYOD/non DEP enrollment
*Thread Reply:* I think @Woody refers to user initiated device enrolment as ‘user enrolment’ - somewhat confusingly. User enrolment has a very specific meaning now, with a MAID required and limited MDM functions. With manual device enrolment, supervision does indeed carrry over - it’s a flag set on the device. The main issue you may want to consider is that the manually enrolled MDM will be user removable; which might be a concern.
*Thread Reply:* Yeah Thomas, I was thinking the same that’s why I asked. I also do share the concerns with the removable mdm profile.
*Thread Reply:* @Thomas B. that's correct. So it is more of a manual enrollment in this scenario. No MAIDs in use. Appreciate you spelling that out. I'm sure it isn't the first time there will be confusion on that nomenclature
*Thread Reply:* The built-in Mail app can't do Shared mailboxes, so I believe Outlook is your best bet.
*Thread Reply:* And if the shared mailbox has the password enabled?
*Thread Reply:* For the Outlook app, If they have delegate access, they should be able to add it by clicking on the add account button and choosing “Shared Mailbox”
*Thread Reply:* VMware Boxer supports Shared mailboxes as well (if you are already using WS1 and have it licensed).
*Thread Reply:* What are you asking about. I have a few devices I am testing this on.
*Thread Reply:* I’ve done some tests and it looks neat to me - quite the improvement over the iOS 14 era process with manual profile install.
*Thread Reply:* agree, user enrollment is really good, but the dependance on Managed Apple ID make’s it tough.
*Thread Reply:* That's promising to hear, I'm a workspace 1 shop here, and having a devil of a time getting the pre-reqs together. (building and hosting the domain.com/.well-known/com.apple.remotemanagment. Any guides specific to WS1 or generally you can point to?
*Thread Reply:* Not really unfortunately I am not well versed on WS1.
*Thread Reply:* Perhaps managed accounts such as calendar/contacts?
*Thread Reply:* We authorise the sync of managed contacts to native contacts
*Thread Reply:* You need to allow Siri even when unlocked. So check for restrictions regarding Siri
*Thread Reply:* @Mark Vonk We blocked Siri for ~un~locked devices and CarPlay works pretty well. When have you checked that?
@Damian Very obvious, but are WiFi or Bluetooth restricted?
(modified the typo)
*Thread Reply:* I am not sure about the current status, but it used to be a common reason for CarPlay to fail. If you Google for locked (not unlocked) you will find some references to it. Siri is still mandatory though, you need to enable it for CarPlay to work
*Thread Reply:* Siri is allowed locked and unlocked and Bluetooth/wifi too. Probably a bug so just reaching out in case it's a known issue. Thanks
*Thread Reply:* We’re telling people that we do not officially support backups as they don’t work as they should in a business context and everything company related is in the cloud and doesn’t need to be backed up. If they still want to use it they can, but they should use iCloud or iTunes/Finder and not the Quick Setup option. If they have issues we still try to help though.
*Thread Reply:* Pretty good - thanks for sharing
*Thread Reply:* To add a bit onto @Jay answer from my own experience, If your company applications are installed by the MDM and you have correctly flagged the apps themselves to not backup (or use iCloud if you want both blocked) then they will not be able to backup. In high security environments the use of backups have long be banned but it make support more painful. By ensuring corp apps that should not be backed up and sharing data to iCloud is correctly flagged that way by your MDM is a good start. Then the use of iCloud Backup should work fine and a users “personalized” settings will be moved but the corp apps will have to pushed down and then data sync’d back from the company.
*Thread Reply:* Todd is spot-on. I’d add that from a corp perspective, all data on phones should be seen as transient. That is to say, the canonical copy is what is on the mail server, in the database, in the backend etc. - the phone just has a local cache. Hence marking those apps as excluded from backup is fine. On restore, MDM pushes down the apps and the data is re-populated from the respective backends
*Thread Reply:* I guess you have to contact Apple to move the APNS account from personal to managed Apple-ID: https://support.apple.com/en-gb/guide/apple-school-manager/axm6603d9206/web
*Thread Reply:* 1. nope… You can’t. It’s privacy 🙂
- not really. but you can move to a different ID if needed. Contact Apple Deployment Support for this. They have a form for this
*Thread Reply:* Privacy yes , but emails are being mailed to users who have conflicts on your email system , so you still “know” if you want to
*Thread Reply:* this has been a huge blocker for us making the migration because we have
- official developers who have historically used their work emails for developing apps
- users who, against corporate policy, used their corporate id We asked Apple for a list of those users so that we could embark on a communication campaign about the transition. Apple said No, privacy. So then we asked for the count so that we had an idea of what we were up against and that was denied as well. So we will be flying blind in the transition.
Once you take over the domain for user enrollment, the users will get a message from Apple indicating that they will need to transition to a personal id.
*Thread Reply:* You can get the count from ABM before you turn on migration and federation…
*Thread Reply:* There is only 2 ways: via Apple Configurator or a reseller adding it for you.
*Thread Reply:* got it. I'm using Configurator now and am able to get my device enrolled into WS1 and in ABM. Process seems a bit quirky and not consistent on the multiple attempts I've tried to enroll a device using a blueprint. Profiles are delivering fine, apps are not installing.
*Thread Reply:* dep/abm via vendor is certainly the easiest
*Thread Reply:* simple answer... no.. Only 1 work 1 personal
*Thread Reply:* I do wish. The best thing is federation/linking between teams, but that's only if both orgs allow for it
*Thread Reply:* @Mark Vonk Do not Disturb (aka Focus)
*Thread Reply:* I don't know @Woody I think @Mark Vonk idea sounds like a lot more fun
*Thread Reply:* I did not see anything in the iOS restrictions documentation regarding focus/dnd unfortunately.
*Thread Reply:* Yeah, likewise. Have someone shopping different MDMs because they think one is going to be able to do something magical with Apple on that front. Hate to break it to them, but that's not going to get them anywhere.
*Thread Reply:* Potential solution on this front. https://lifesaver-app.com/
*Thread Reply:* Apple can’t. MDM can (if device is online and enrolled)
*Thread Reply:* Thanks for the verification. I never thought they did but our SureMDM vendor was trying to tell us they can.
Unfortunately in our case the phone is passcode locked and has been turned off then back on. And we know when that happens iOS turns off the data connection until the device is unlocked.
*Thread Reply:* if this is an SIM capable device just plug in an unlocked SIM. If it’s not use a Lightning to USB-A to Ethernet adapter or just a USB-C to Ethernet if you have an iPad Pro… that brings the device back online 🙂
*Thread Reply:* You can always wipe the device if you don’t care about the data.. Put it into DFU mode and restore using a cable.
*Thread Reply:* Thanks for that info Peter much appreciated. Our customer was hoping to keep the data otherwise for sure we could have just wiped it early on. But that is good to know about Lightning/USB-C to Ethernet adapters.
Hadn't heard of that one before.
Thanks again!
*Thread Reply:* I have this “kit”
*Thread Reply:* https://support.lenovo.com/dk/en/solutions/pd029741
*Thread Reply:* awesome thank you so much for the recommendation
*Thread Reply:* Hi Peter,
Have you ever ran into the issue where the iOS device will tell you that you need to unlock the device before you can use USB accessories?
*Thread Reply:* Yes, that limitation has been introduced a while ago. MDM is able to change this policy - but you would’ve had to do this ahead of time.
*Thread Reply:* The restriction is “allowUSBRestrictedMode” - found in https://developer.apple.com/documentation/devicemanagement/restrictions
That site is really valuable to have on hand in this type of vendor discussion - it is the canonical answer to what MDM can or can’t do.
*Thread Reply:* Do you have an applecare case or a FB with AppleSeed?
*Thread Reply:* Not yet but we can definitely create one. I was just putting this out there in case anyone had experienced the same issue
*Thread Reply:* @Todd Cole anything you’ve come across?
*Thread Reply:* I find the updated deployment guide to be quite helpful; https://support.apple.com/guide/mdm/prepare-shared-ipad-mdm71124b400/web - with some interesting details in the referenced MDM spec. https://developer.apple.com/documentation/devicemanagement/settingscommand/command/settings/shareddeviceconfiguration. Some noteworthy comments:
> Apply this setting before users log in to the device.
> If you upgraded the device to iOS 13.4 or later, perform an erase of all content and settings before applying this setting.
> Provide either the QuotaSize or ResidentUsers. If you provide both values, the MDM server uses QuotaSize.
What MDM’s are you seeing this with? Some vendors may have quirks in their implementation.
*Thread Reply:* Hi Thomas, the devices are running 15.5 at least. We noticed this on MobileIron Core and Intune. Within MobileIron and Intune this value is set in the enrollment profile which applies before any user signis in. MobileIron applies Resident user , indirectly I noticed that Intune does the same, Although it is not documented that obvious as at MobileIron.
*Thread Reply:* Aloha! Can you confirm that no user QuotaSize is set in the test setup?
*Thread Reply:* I am almost sure (checked) you can only set max resident user, no quota size within Intune and MobileIron, but please tell me if you experienced otherwise.
*Thread Reply:* Fwiw, the setting isn't Max in the API; it's just ‘residentUsers’ which is the expected number.
*Thread Reply:* Do the local cached accounts use all of their allotted quota in your test? And do you actually see all 11 accounts as recent accounts on the login screen?
*Thread Reply:* @Woody Sorry I have been on paternity leave and not on slack for a month! There is a video that gets into this a bit from WWDC this year (I believe it is the device management video) but the basic concept is either the OS balances the available space based on users (say 10 and it assigns the space available per) or space per user (separate option) when both are defined it get tricky. I would verify that the MDM is not defining both but only one or the other control.
*Thread Reply:* Yes, device wide VPN is supported on iOS as well as Android devices, but you need to enable it manually in Defender app
*Thread Reply:* If you’re referring to Platform SSO, that is macOS only.
*Thread Reply:* Platform Single sign-on (SSO) for macOS SSO extensions allow a user to enter their credentials once, so that subsequent apps and websites don’t require the user to repeatedly reauthenticate. But historically, SSO extensions worked only after a user logged in with their local credentials to macOS. Platform SSO allows developers to build SSO extensions that extend to the macOS login window, allowing users to use an Identity Provider (IdP) password to unlock their Mac. The local account password is automatically kept in sync, so the cloud password and local passwords match. Users can also unlock their Mac with Touch ID and Apple Watch. There are two supported authentication methods: • Authentication with a Secure Enclave-backed key: With this method, a user who logs in to their Mac can use a Secure Enclave-backed key to authenticate with the IdP without a password. The Secure Enclave key is set up with the IdP during the user registration process. • Password authentication: With this method, a user authenticates with a local password or an IdP password. Requirements Platform SSO requires the following: • macOS 13 or later • An SSO extension payload that includes support for Platform SSO • Support from the IdP for the Platform SSO authentication protocol • A supported mobile device management (MDM) solution ◦ Note: If the Mac is unenrolled from the MDM solution, it is also unregistered from the IdP.
*Thread Reply:* I’d argue you already could - disable profile installation, disable trusting external developers, maybe disable USB data access…
*Thread Reply:* Also if you are in the Beta/Seed program file feedback asking for MDM capabilities you think are needed.
Hi, anyone is experiencing issues with Intune / iOS 15.5 and DEP devices since a few days? we can't stage iOS devices anymore - the iPads get stuck in Intune single-app mode although they are flagged as compliant and authentication succeeds https://www.reddit.com/r/Intune/comments/v6ol52/ios_devices_that_are_currently_under_an_abmdep/
*Thread Reply:* Aloha Pierre! I would concur, there might be room for somebody to offer that, but I haven’t seen many. Def not on a global level, local experts (e.g. in Apple Consultant Network or with local AAER) may offer options. Some MDM vendors have decent training - Jamf, VMware come to mind - that might serve your needs. Combined with the new self-paced training at https://training.apple.com/it you could get quite far.
*Thread Reply:* Good recommendations, @Thomas B.!
*Thread Reply:* Thnx! I forgot one important suggestion - to connect with a friendly Apple SE in your region. These teams aren’t huge so they may get busy but will have great pointers for you, as wel as invites to (virtual) Tech Camps with the latest content and connections to the wider Apple org (think Apple Professional Services, Consulting Engineers etc.)
*Thread Reply:* You may also want to join the AppleSeed channels in the
*Thread Reply:* First I've heard that this should prevent screenshots or screen recordings. We are testing it currently for copy & paste restrictions (we don't apply the allowScreenShot key). It does not yet work with Managed Domains in Safari (can't paste from a managed app into any website in Safari, even if it is part of the ManagedDomains list), but that's supposed to be fixed in iOS 16. Another bug is that it prevents pasting a signature from a managed mail account into the signature settings - I should probably open a feedback for this.
*Thread Reply:* And the workaround, as always, is to take a screenshot and then copy the text from the image. Works quite well 😉 But I guess this is what you are trying to prevent.
*Thread Reply:* Managed pasteboard does not do anything against screenshots. It disallow copy/paste of text from managed apps. It works, but not for Safari managed domains.
*Thread Reply:* Thanks for the feedback guys - I was sceptical at best 😉
*Thread Reply:* If you would like to pile on: FB10768591 - requireManagedPasteboard blocks pasting mail signature into managed mail signature setting
*Thread Reply:* There is of course the classic restriction to block all screenshots. Although in this day and age one has to wonder - if the employee is intent on exfil of data, they can use a plethora of options including their trusty Xerox machine. Isn’t that more of an HR problem?
*Thread Reply:* To my understanding, Apple has yet to make available the option for 3rd party MDM vendors to grant admins the ability to set the default browser on a managed iOS device.
Though I have yet to venture into the world of Intune MAMD config, good to know about Outlook + Edge.
*Thread Reply:* Been trying to figure that one out myself. I learned the Mail app cannot be managed using VPP as it cannot leverage the InstallAsManaged key.
This due to the intention of the email account is expected to be managed and not the app when managing an iOS device.
*Thread Reply:* @Pierre Michaud that makes sense. Suppose the only way to prevent this on company assets is to prevent the deletion of apps as a whole (iOS Restriction)
*Thread Reply:* @Pierre Michaud I believe I saw an MDM feature that would re-push all system apps. I’ll have to check but it may have been MobileIron Cloud/Ivanti Neurons.
*Thread Reply:* @Woody Please keep me posted!
*Thread Reply:* What?!!? Such a thing exists? Had a chance to try it?
*Thread Reply:* @Pierre Michaud Apparently! I have not had a chance. Will try it when i have a chance.
*Thread Reply:* Thanks for confirming! Look like I will have to put in an FER with the vendor for my MDM solution :)
*Thread Reply:* Welcome @Pierre Michaud! I was pumped to see it work as well. Can’t believe this has been overlooked by so many vendors.
*Thread Reply:* There is a "network usage rules" payload that you can use, but you need to specify each apps that you want to restrict. Alternatively, you can use cloud proxy solutions.
*Thread Reply:* @Mathieu Beaugrand I did see that was I was looking around, but it’s similar to specifying allow/deny lists for apps. Would be cleaner if they just supervised these devices and only allowed apps to be installed that they want used. Agree on the cloud-based proxy. My gut says they’d first use Supervision and then if it leans more towards COPE engage a cloud proxy
*Thread Reply:* Will this help? https://www.ibm.com/support/pages/dep-ios-backup-and-restore-guide
*Thread Reply:* Nice @Peter Mohr! Bookmarking that one.
*Thread Reply:* My only question is… the personal iCloud account that was on the device previously… it continues to exist, yet activation lock/etc would no longer be applicable (due to AMB/Supervision). Correct?
*Thread Reply:* @iMZ to answer your questions.
1) sorry don’t have a screen recording just yet 2) if enabled, data is NOT available on iCloud.com 3) no the data will not be available as even Apple do not have access to your data. 4) no managed Apple ID’s is not an option.
All answers are in this link - https://support.apple.com/en-us/HT212520
*Thread Reply:* Just going by the doc 🤷♂️:skintone4: haven’t personally tried it yet
*Thread Reply:* When you say wrong, is it wrong or just not working as per their documentation?
*Thread Reply:* You can access data on iCloud.com
Apple transfer the decryptions keys on runtime from the device to display the data within the browser
*Thread Reply:* What's the use case? Something like a global helpdesk number on all devices? Could be pushed via web clip and deeplink to the phone app so users tap the web clip and it starts the call.
*Thread Reply:* Use case would be to share OTP per SMS with the users for example, obviously after they verified the phone number with us. Not so much for calling, really more for texting information in case user password gets reset, as another example
@Jay I don’t believe so. Closest thing I’ve seen is something like this from @Peter Mohr’s company: http://phonebook.conscia.com/FAQ
*Thread Reply:* Yeah. Ping me if you need help with this. Should be pretty easy though :-)
*Thread Reply:* @Peter Mohr Question about the Corporate Phonebook. I am looking for a solution that I can use to keep a list of contacts that i want to update centrally but my end users can use the contacts in a way that is similar to the native contacts app. Key here is that I need to make sure that the “central office” can specifically control the “company contacts.” The teams already have a company directory (thing big HR managed data, Office 365) but want a tool for the smaller team (think about 70 people) where this regional team’s info is maintained as they rotate throughout the larger company often. I need a way to say ” the person for region a is XXXX” and have the contact info for that be central. Does this make sense and will this app do that?
*Thread Reply:* The app doesn’t do this 😞 I once looked at this company/product suite…
https://cirahub.com/two-way-contact-sync/
Peter
*Thread Reply:* Thank you for the recommendation
*Thread Reply:* @Woody the feature called "Mail Privacy Protection [which] works by hiding your IP address and loading remote content privately in the background". It pops whenever you first launch the Mail app after deploying an EAS payload for the native Mail client. It can also be found in Settings > Mail > Privacy Protection.
*Thread Reply:* Ahhh, okay @Steven. I don’t believe I’ve seen a control for that in either Apple Configurator or any of the MDM Payloads.
*Thread Reply:* Is this really becoming a thing? And would you really want to do that on BYOD?
*Thread Reply:* It’s been banned in 18 states in state government devices. But not on BYOD. Use MAM to Protect your data.
*Thread Reply:* Not reflecting my own views; let me play devil's advocate: "Don't we ban other malware on BYOD, or at least have the MTD trigger non-compliance?"
*Thread Reply:* It’s a slippery slope to go down. If you’re that concerned IMO, don’t do BYOD.
*Thread Reply:* It really depends on the “data” you want to protect. MAM does not protect you against any of the data TikTok collects, excepts for contacts maybe. If you need to secure for example location data, indeed you might be better off handing out corp phones.
*Thread Reply:* Following this closely as all Government organizations have establish bans on the app now for their company phones . There must be some one who works with them here . Was it just a blacklisted app in W1 as I thought there was limited capabilities in iOS for this.
*Thread Reply:* You can either have the vendors who provided all the devices remove them from one and add them to the other. Or you could take all the devices in manually add them through Apple configurator. Depending on how many devices you have to deal with one would be easier than the other, of course. That’s really the only way to do it.
*Thread Reply:* We found out at the end that the apple reseller can just move them from one ABM to another with a stroke of a pen. Thanks.
*Thread Reply:* I think you got lucky with the vendor . One having a single source of purchases and then also having them do the work. Seems like a lot of resellers are batting about 500 on the technical expertise and execution.
Today Klaus Rodewig held a very interesting #webinar ( https://lnkd.in/e47iefMs ) about the APIs of #Apple #iOS/ #macOS / #tvOS and #watchOS. It was a great opportunity to learn more about the usage of these APIs and to learn from an experienced expert. I am sure that both developers and administrators benefited from this webinar and it will help them to successfully implement their projects.
I was able to help Klaus with the "Shared with you" feature by sending him links to my #Podcasts https://lnkd.in/e4NrcgQE and https://lnkd.in/e9EwTCGX via iMessage, where I had the opportunity to give interviews in 2022.
The #Heise Mac&i Pro offer is not only for #developers, but also #administrators can benefit from the presented content and take away valuable information for their work.
german #content
*Thread Reply:* Not sure about your question. You can for example supervise a device with Apple Configurator instead of having to enroll it in a MDM. The device gets supervised the same way it would via a MDM. You can even deploy profiles and apps via AC. It can replace a whole MDM in some way.
If you just want to use AC to have your device attached to ABM in order to use Automated Device Enrollment feature with a third party MDM, here is the process : • Link your ABM "Organization" to AC • "Prepare" your device via "Manual configuration" and tick "Add to ASM or ABM" • Let AC add the device to ABM • In ABM, move the device from "Apple Configurator" to your current MDM • Check your MDM for specific actions after adding the device (like assigning a DEP profile) • Enroll your device :)
*Thread Reply:* Thank you..we already tried this and able to add into ABM portal with user affinity.
*Thread Reply:* But if we just want to supervise the device without adding into ABM portal..will i be able to enroll it later into any MDM
*Thread Reply:* You need an ABM to get the device supervised. AFAIK it's not possible to do it without ABM. But if it's in ABM you can leave it unassigned so it is not enrolling to any MDM.
*Thread Reply:* Why do you need supervision? it only get you access to a few more profile commands? Maybe the passcode reset?
*Thread Reply:* Yes, you can supervise a device only via Apple Configurator and then manually enroll later into MDM. We have done this with many devices.
*Thread Reply:* It’s an iOS feature controlled by the carrier settings of each iOS build
*Thread Reply:* Oh really? Where did you get that info? 😉
*Thread Reply:* From Apple… we had a private session with them about carrier settings in general 🙂
*Thread Reply:* Nice, I’ll fire off a quick email to our account team to see what they come back with! Any particular reason they have for implementing this other than the one I mentioned?
*Thread Reply:* Weird though, as I see it only on iPad and never on iPhone, same carrier network on the devices... can it be targeted towards certain device types
*Thread Reply:* Carrier Settings is per device model. Each model has their own so iPhone 8 can be different from iPhone X etc. you can download the ipsw files for each model and check the settings for each carrier if you care to :-)
*Thread Reply:* Hi Peter, can you please explain how I can check those settings on an IPSW file? I tried looking into its files but couldn’t find any carrier-related setting.
*Thread Reply:* On more recent iOS versions (15.4 or later) , the old carrier size limit for OS updates on cellular in the carrier configuration is no longer applied.
*Thread Reply:* @Amine the carrier bundle extraction flow looks something like this:
1) Download .ipsw 2) Rename to .zip 3) Unpack 4) Find largest .dmg inside folder 5) Mount .dmg 6) Look into /System/Library/Carrier Bundles/ folder in the mounted volume 7) TDC DK is called: TDC_dk.bundle (Find your own carrier… 🙂 ) 8) Copy .bundle. Rename to .zip Unpack…
*Thread Reply:* @Thomas B. this is still a carrier setting under carrier control but you’re correct that carrier setting are no longer send to device “out-of-band”. Now they are only pushed as part of iOS updates
*Thread Reply:* The values no longer have the effect they had - some customers have been surprised by the change… It makes sense though, the ability so set the limits that made sense in 2007 for iPhone doesn’t really apply anymore in 2023 where data is abundant.
*Thread Reply:* The limits are STILL in effect if the telco choose to have it so. TDC in Denmark still limits the downloads and the OS updates on cellular. The other carriers in DK have removed their limits…
*Thread Reply:* Thanks for that detail! I had only heard from 1 carrier in the US so far still enforcing any limit, but I’ll take your local expertise. The challenging part for me is that most carrier employees won’t have knowledge of this mechanism nor their setting, so for me, the changes with 15.4 have been a great help.
*Thread Reply:* Are these personally enable (i.e. COPE) devices? In that case i’d probably direct the user to https://support.apple.com/HT201656 and start there to figure out where the space is used.
*Thread Reply:* Yes there is a password autofill restriction: https://support.apple.com/en-euro/guide/deployment/dep0f7dd3d8/web
*Thread Reply:* For those interested to try, Mosyle has this in their beta feature set now that you can easily opt-in to. Makes for a fun test.
*Thread Reply:* Only Apple apps/processes have access to the keychain where the certs are store. So no!
*Thread Reply:* Gotcha. Except „Jailbreaking“ or using OS vulnerabilities
*Thread Reply:* true, but then you can never trust your devices and shouldn’t use them for anything 🙂
*Thread Reply:* This might be helpful info on how keychain works: https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/1/web/1
*Thread Reply:* The larger Data protection section is also very informative on how all the crypto works.
*Thread Reply:* You could look into ACME and Managed Device Attestation with Secure Enclave backed certificates - those are the ultimate answer for this type of concern.
Classic MDM deployed certificates can be included in the backup, so blocking backup (and data access via USB in general) would be one measure to consider as an intermediate step.
I’d also be interested to understand the risk perspecive - even if the CISO threat model includes an employee that is actively subverting security controls, I don’t believe technical controls would be the appropriate answer necessarily…
*Thread Reply:* Isn’t that just a Safari webview?
*Thread Reply:* That’s was my thought. However, unlike other Safari webview and WebKit prompts, when I pull up the Captive Portal I don’t see an entry in my console logging like this:
FilterControlExtension Flow seen with Remote Endpoint 13.107.21.200:443, protocol: 6, AppID: .com.apple.mobilesafari, AppVersion 16.6, URL: https://www.bing.com/, Result: Blocked
We have a plug-in Content Filter that can allow or block traffic to apps and websites. Pretty much any app bundle ID appears in the logging. Seeming all but the Captive Portal.
*Thread Reply:* Com.apple.captive and com.apple.WebKit.WebContent.CaptivePortal show up in my searches
*Thread Reply:* I think I’ve got this solved. Our logging was not picking up NEFilterBrowserFlow traffic. A little tweak to that and we get: com.apple.Websheet
So, for anyone encountering something like this com.Apple.Websheet is the App ID the Captive Portal is using.
*Thread Reply:* Thanks Almar must have overlooked that. But looks like the answer is no as we have two seperate tenants
Hi folks, anyone aware of what this means? I can’t really find any other info on this. Thanks https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/services/GettingReadyForAppleReleases/GUID-GettingReadyforAppleReleases2023.html
*Thread Reply:* For unsupervised devices there is not much you can do except mark those non-compliant and block email, etc if these Intune enrolled. Otherwise enforce the iOS version using the MAM application protection policy.
*Thread Reply:* I tend to always disable Compromised Protection no matter what. It's the same story for each major iOS release 😐
*Thread Reply:* You mean turn it off temporarily until VMware release the fix or off altogether ?
*Thread Reply:* You can use Compliance Policies instead. Same detection of compromised devices, but you decide what are the actions instead of a default "device wipe" from Compromised Protection setting.
*Thread Reply:* Yep, i just checked and this is actually what we do (use a compliance policy and disable this setting)
*Thread Reply:* We had a similar issue with the VMware tunnel app for iOS which got stuck on the DTLS channel when the merge between TCP/UDP channels failed. The client was not intelligent enough to recognize and terminate the session thus became stuck in a loop consuming battery power in the process. It might be something similar with your Citrix client ?
*Thread Reply:* Interesting. Thanks for your reply! Had a look into the client logs and it seems to listen to any system broadcast where the device is stating “awake”. However, I’m 100% sure that the device has been on my desk during the night 😄
And, in regards to your path:
"DTLS Mux setup timed out. No response from NSG?
[Nov 2, 2023 at 11:20:49 PM GMT+1] <Debug>: Control channel creation successful.
[Nov 2, 2023 at 11:20:49 PM GMT+1] <Debug>: controlChannel Fd 11 and stream <NSGIoStream: 0x1032a61e0>
[Nov 2, 2023 at 11:20:49 PM GMT+1] <Debug>: Control Channel stream is <NSGIoStream: 0x1032a61e0>
[Nov 2, 2023 at 11:20:49 PM GMT+1] <Debug>: Creating DTLS MUX
[Nov 2, 2023 at 11:20:49 PM GMT+1] <Debug>: Control connection setup successful. GW: <PUB-IP>
[Nov 2, 2023 at 11:20:49 PM GMT+1] <Debug>: NSGTunnelParameters - Updating tunnel status from 3 to 3
[Nov 2, 2023 at 11:20:49 PM GMT+1] <Debug>: [C261 <PUB-IP>:443 udp, tls, attribution: developer, path satisfied (Path is satisfied), viable, interface: en0[802.11], scoped, ipv4, dns, uses wifi] transition to preparing
[Nov 2, 2023 at 11:20:49 PM GMT+1] <Debug>: [C254 <PUB-IP>:443 udp, tls, attribution: developer, path satisfied (Path is satisfied), viable, interface: en0[802.11], scoped, ipv4, dns, uses wifi] transition to preparing
[Nov 2, 2023 at 11:20:50 PM GMT+1] <Debug>: DTLS Mux setup timed out. No response from NSG?
[Nov 2, 2023 at 11:20:50 PM GMT+1] <Debug>: setting Control channel <NSGIoStream: 0x1032a61e0> read handler
[Nov 2, 2023 at 11:20:50 PM GMT+1] <Debug>: [C261 <PUB-IP>:443 udp, tls, attribution: developer] cancelled
[Nov 2, 2023 at 11:20:52 PM GMT+1] <Debug>: Device going to sleep, tunnel status 3.
[Nov 2, 2023 at 11:20:52 PM GMT+1] <Debug>: No current connections
[Nov 2, 2023 at 11:23:49 PM GMT+1] <Debug>: Device wake up from sleep, tunnel status is 3.
[Nov 2, 2023 at 11:23:49 PM GMT+1] <Debug>: No current connections
[Nov 2, 2023 at 11:23:49 PM GMT+1] <Debug>: PacketTunnelProvider: (0) Re-establishing control channel because of a system wake event. (networkIsDown: 0)
[Nov 2, 2023 at 11:23:49 PM GMT+1] <Error>: checkConnectivity - connect result = -1 (errno=36)
[Nov 2, 2023 at 11:23:49 PM GMT+1] <Debug>: Connectivity check. select() call return value = 1
[Nov 2, 2023 at 11:23:49 PM GMT+1] <Debug>: Trying to re-establish control channel.
[Nov 2, 2023 at 11:23:49 PM GMT+1] <Debug>: NSGControlChannel - Appending HTTP headers
[Nov 2, 2023 at 11:23:49 PM GMT+1] <Debug>: NSG control Channel Request: [HTTP REQUEST ...]
*Thread Reply:* This was happening to me today too. But it finally resolved itself.
*Thread Reply:* Yeah -- I left a device in the system overnight and it worked itself out. Sort of frustrating, but at least it self-resolved.
*Thread Reply:* Happened to me yesterday too. After a couple of hours, the device showed up in ABM
*Thread Reply:* wow @Damian not good! Keep us posted if you can
*Thread Reply:* Sounds like the godaddy certs just need to be added into ssl pinning in the console
*Thread Reply:* Well, those certs are present in the Apple native cert store so I don’t see why iOS is complaining. What would putting them in the ssl pinning section of the console help in any way?
*Thread Reply:* Has nothing to do with the device itself. In the ws1 console you have pinning setup with the full chain and it tells the client device who the issuers are. The client is being told who the exact certificates are and to not trust anything else
*Thread Reply:* So if you have a pinning issue it is most likely the pinning configuration
*Thread Reply:* APNs doesn't use WS1 cert pinning though.
*Thread Reply:* The MDM Push certificate portal is managed by Apple. If they're not trusting the MDM commands from a service that's using their own certificate for APNs, that's really bad.
*Thread Reply:* We also see that an (increasing?) number of devices are no longer reporting their iOS version or installing profiles. Did anyone identify a solution for devices no longer communicating via the MDM protocol that does not involve a device wipe and re-enrollment? (WS1 MDM)
*Thread Reply:* We have been on a bridge every 2 days with Apple/VMware since a month and they have yet to pin point the issue or issues.
According to the APNS team, the device is seen as offline as the device token is no longer active from the « topic » that is created to process the notifications. The reason behind this is apparently due to a malformation of the request sent by UEM that the APNs refuses…so for now VMware and Apple are battling it out!
Another issue is that post reboot, the device is supposed to (as per design) checkin to the MDM but this is not happening either.
*Thread Reply:* Here are the associated logs:
Registration of the topic:
2023-12-07 13:19:46.021805 0100 0x892 Default 0x0 134 apsd: (apsd) [com.apple.apsd:connectionServer] Creating server: with connectionPortName: com.apple.aps.managedconfiguration.mdmdpush-prod user:
Errors:
Line 1303: 2023/12/07 12:50:28.753 DE02PCN1549GA1 11901f8f-4e80-4dbd-a5a6-ca922631a8f6 [
Line 1306: 2023/12/07 12:50:28.753 DE02PCN1549GA1 11901f8f-4e80-4dbd-a5a6-ca922631a8f6 [
*Thread Reply:* Thanks, that sounds like it could be fixed by VMware at least. Can you share the Apple and VMware ticket numbers?
*Thread Reply:* It’s a strange one as it’s only 3000 devices (5% of our fleet) that is affected. I’m wondering how these packets become malformed…
*Thread Reply:* We have our own individual incidents raised on each side but there is a collaborative incident between Apple and VMware regarding this. I’ll fish it out and send across in a bit.
*Thread Reply:* This is a difficult one, @Damian I am curious to hear the resolution.
*Thread Reply:* Hello and Happy New Year folks.
Ok. So basically Apple rolled out a fix in 17.1 to address the cert chain issue that prevented the devices from checking in to UEM.
https://support.apple.com/en-gb/HT213892
This helped to solve 1/4 devices according to our tests but most never recovered. Apple then told us that the device token issued by the MDM was changed by iOS. I asked why and when that happens but was told it’s proprietary information related to the security of the device. Typical…so for these remaining impacted devices, what happened was that the packet sent by UEM to the APNS never reached the device because the token on the device side didn’t match the one on APNS. It seems that at some point when the first issue related to the certs was present that the device token changed and was unable to inform UEM. This then meant that the device was unable to recover and became stuck in a limbo state. A small number recovered which means that their device token didn’t change and thus when they upgraded to 17.1 the MDM accepted the connection. This is what I find strange that in all the months when many of these devices were cut off from MDM that their device token didn’t change??? Again Apple won’t tell us…so I smell bullshit…so basically we need to reenrol 3000 devices to solve the issue hoping it doesn’t happen again…again no guarantee from Apple…
*Thread Reply:* If it lost the apns certificate that tracks
*Thread Reply:* It’s not the APNS cert but the device token that is used by APNS to identify it
*Thread Reply:* Yep insane…not even a guarantee that the issue could rear its ugly head again and even why this token changed for a certain number of devices and not for others which were all offline with the same issue…
*Thread Reply:* Ok, so after insisting that they stop taking the piss re their proprietary info argument, Apple has theorised that the device token change happened during the 1st issue with the certificate chain when the device was offline because the security posture of iOS changed - they are guessing that it was due to an invalid MDM installation found but cannot be sure as they didn’t have the logs at the exact time it was changed. You couldn’t make this shit up!
*Thread Reply:* So, cue reenrollment for approx 1000 devices…
*Thread Reply:* 40,000 iOS devices are upgraded to 17.2 now….
*Thread Reply:* It seems to only be impacting users with a lot of contacts…
*Thread Reply:* like how many? I have 2000 contacts and no issues so far
*Thread Reply:* It’s a lot more than that apparently - some VIP users have 20,000 - yeah I know it’s ridiculous but you know how it is…will keep you posted if anything else happens but I just had 2 apps crash on me - intelligent Hub and Planner and I haven’t seen crashes in a long time…
*Thread Reply:* https://discussions.apple.com/thread/255340169
*Thread Reply:* Our CEO has just been impacted and I believe he doesn’t have that many contacts, just a few hundred. We’ve just gone ahead and communicated internally on this and opened a critical case with Apple. Strange that no one here is reporting this…
*Thread Reply:* Interesting. I had a ticket open for a customer for 6 months with Apple for a high data usage issue related to Contacts (iOS was using GBs of data toward gmdf.apple.com as soon as the Contacts list had few thousands entries). They fixed it with 17.2, but it seems they broke something else…
*Thread Reply:* It is really strange, I don't think it can be supervised like this as you have to go to settings to enroll with account-driven enrollment
*Thread Reply:* I wonder if it might me different for Mac and iOS devices
*Thread Reply:* sure, but how to clarify ?. anyone already testing the ADDE ?. if so can share the view ?.
*Thread Reply:* Actually it seems that there are still some limitations with ADDE for example you can’t see or managed the apps in the user side
*Thread Reply:* But you also get full access rights on the device
*Thread Reply:* If I remember correctly you also get the same limitations as UE, you cannot ask for management of an already installed application, so users will have to remove the app and the MDM can then prompt for installation, and if you remove the ADDE account the device is not enrolled anymore
*Thread Reply:* Any idea what mdm support it? I cannot find doc for Ivanti, Intune and WSO
*Thread Reply:* we need to know deeper about ADDE possibilities and cons... ! trying to get , let me share some update once i get some information...
*Thread Reply:* we don’t support it, but I should be able to easily test this with our own MDM
*Thread Reply:* please do share when you know the results.
*Thread Reply:* With iOS, ADDE does not result in Supervised devices, similar to Profile based device enrolment would do. With macOS is does, with the noted exceptions. This was documented in pretty good detail in the release notes PDF available through AppleSeed beta testing program IIRC.
*Thread Reply:* Found it in here; https://appleseeddownload.apple.com/appleseed_for_it/asit2023/Whats_New_WWDC_2023_v1_2.pdf
*Thread Reply:* It’s now also in the Deployment guide - https://support.apple.com/en-gb/guide/deployment/depd1c27dfe6/1/web/1.0#depfd2eb8980
*Thread Reply:* thanks for your sharing and updates... ! i will read those documentation.
*Thread Reply:* Same has been clarified by apple in a forum https://developer.apple.com/forums/thread/735541 comments "On iOS device the only way to get supervision is to use Automated Device Enrollment or Apple Configurator. The supervised state via ADDE comes only on macOS. — Systems Engineer months ago"
*Thread Reply:* Answers found and we can close this topic.
*Thread Reply:* There should be an “Allow host pairing” option in your MDM, once enable that should sort the problem out.
*Thread Reply:* yes, the device actually opens the link and then renders the preview... To the phising/pen-test team this looks like a user clicked the link
*Thread Reply:* Yes, this is what I thought 🙂
If anyone is interested, the following MDM restriction has been documented in 17.4 beta 2 to disallow third party AppStore installation
https://developer.apple.com/documentation/devicemanagement/restrictions
*Thread Reply:* Looks like it doesn’t require supervision. Am I reading that right?
*Thread Reply:* Confirmed by Apple - all iOS restrictions for third-party AppStores will require supervision (which is what I expected)
*Thread Reply:* When we can try this restriction profile in our MDM/Apple configurator ?. for NON-Supervised devices we dont have any option to restrict the 3rd party Appstores ?.
*Thread Reply:* Hiding/Blocking those Marketplace App or Bundle id can help for NON-Supervised devices(managed devices) ?.
*Thread Reply:* another nice article i found to block the market place , very nicely written by an MVP : https://www.intuneirl.com/alternative-app-stores-not-on-my-supervised-devices/
*Thread Reply:* following - as we have a requirement that may warrant this but just haven’t got round to actually playing with it fully yet
*Thread Reply:* We have played with it too, but I'd really like to hear from anyone using it in a production environment. Operationally I think shared iPad adds a ton of overhead.
*Thread Reply:* From what I’ve read I 100% agree and that’s half the reason why I haven’t played with it yet. If it was as simple as Android and doing it with some kind of launcher that overlays on the screen for sign-in/sign-out that would be amazing but it’s the use of managed AppleIDs that I don’t like
*Thread Reply:* Also, it doesn't connect the authentication to the device to extensibleSSO. This would be the game-changer we need if it could/would do that.
*Thread Reply:* We use Temporary Sessions for some use cases. But federating ABM is holding us back….
*Thread Reply:* What about federation is holding you back?
*Thread Reply:* We are federated and it works but it’s behind the Apple school program , I can’t set timeout Lock Screen and it’s 2 minutes. Also would be good to be able to use a different passcode or something like authenticator app. Some apps also do t support the shared mode at all
*Thread Reply:* If you find GitHub stuff readable, here is a link: https://github.com/apple/device-management/compare/release...seediOS-17.4macOS-14.4
*Thread Reply:* MY MAN thank you @Mark Vonk
*Thread Reply:* holy lord what a terrible day to have eyes
*Thread Reply:* There is also the Apple Platform Deployment Guide section for Vision Pro: https://support.apple.com/en-ca/guide/deployment/dep18daf732d/1/web/1.0
*Thread Reply:* Additionally, JAMF says that Management capabilities are available in Jamf Pro 11.3.1 for Apple Vision Pro devices with visionOS 1.1 . https://learn.jamf.com/en-US/bundle/technical-articles/page/Vision_Pro_Management_with_Jamf_Pro.html .
*Thread Reply:* Well the actual test will be when the first third=party appstore comes available (from what I have heard Mobivention will launch their appstore tomorrow). But when looking at the management profile on my device, going to restrictions, the restriction it there.
See https://www.intuneirl.com/alternative-app-stores-not-on-my-supervised-devices/ for Intune.
Supported from today by Miradore.
Microsoft has it on there in-development. https://learn.microsoft.com/en-us/mem/intune/fundamentals/in-development#iosipados
*Thread Reply:* Hi Damian, are the issues you are seeing in 17.4 or in 17.5 beta?
*Thread Reply:* Currently seeing them on 17.4.1
*Thread Reply:* Don’t hesitate to open a case and bolt on to ours: 102274595372
*Thread Reply:* What would be super, super valueable is to install the latest beta and share feedback into AppleSeed to confirm the fix - sometimes there are multiple issues at play and if the fix isn’t effective for you, sharing that now is probably your best bet for seeing a fix in 17.5.
*Thread Reply:* The issue still isn’t fixed in 17.5 beta 3 so I’m going to share that via Appleseed and the ticket
*Thread Reply:* Just to let you know that all the issues were finally fixed in beta 4 and public 17.5.x also ok
*Thread Reply:* The SSO provider developer could use a SFSafariViewController thing to authenticate against the backend. This allows for CBA
*Thread Reply:* It would be interesting if they allowed defining the Bundle ID and App Group that could utilize that certificate through an app keychain. What is the priority of this feature request? Do you know?
How you could work around this is to use an MDM SDK within the eSSO app which consumes the certificate payload via the SDK, then stores that certificate in a shared keychain for your App Group. That's assuming that you're building your own eSSO.
*Thread Reply:* I know that they are working on it but don’t know the priority. Have you opened a case to bolt on to this? The more the merrier. Re: eSSO - we’re not building our own but interesting all the same
